Security group FireEye is reporting there is a vulnerability in all versions of the iPhone and iPad when you download an application. Basically, the exploit uses a vulnerability in the way that applications outside the app store are identified. It allows a bad application to replace a good, trusted application on your device, allowing the bad app to have all of the credentials as the app it replaced – including login information. To mitigate this vulnerability, FireEye recommends: 1. Don’t install apps from third-party sources other than Apple’s official App Store or the user’s own organization 2. Don’t click “Install” on a pop-up from a third-party web page, no matter what the pop-up says about the app. The pop-up can show attractive app titles crafted by the attacker 3. When opening an app, if iOS shows an alert with “Untrusted App Developer”, click on “Don’t Trust” and uninstall the app immediately
Posted on: Tue, 11 Nov 2014 18:07:18 +0000