I²R and SMU strengthen security of iOS platform with mitigating measures on proof-of-concept attacks

[Singapore, 2 October 2013 (Wednesday)] - Researchers from the Infocomm Security Department at A*STAR’s Institute for Infocomm Research (I²R) and Singapore Management University’s (SMU) School of Information Systems have identified three proof-of-concept attacks which can be performed by third-party applications to threaten the security of the iOS  platform. The attacks, which include pass-code cracking, interference with or control of telephony functionality and sending tweets without the user’s awareness and permission, have been rectified by Apple Inc in its latest operating system, iOS 7.

Apple’s iOS operating system is one of the most popular mobile operating systems in terms of the number of users. As of January 2013, 500 million iOS devices have been sold worldwide, and Apple’s iTunes App Store has over 800,000 iOS third-party applications with downloads exceeding 40 billion. ^[1]

Third-party applications are pervasively installed on these iOS devices as they provide various functions that significantly extend the usability of the mobile devices. However, these third-party applications pose potential threats by compromising the personal and business data stored on the devices.

Between June to October 2012, I²R and SMU researchers embarked on a task to unveil a generic attack vector that enables third-party applications to launch attacks on non-jailbroken iOS devices. The research team constructed multiple proof-of-concept attacks such as cracking the device PIN, blocking incoming calls and posting unauthorised tweets. To overcome these security breaches, the team proposed several mitigation methods to enhance the vetting process and the iOS application sandbox. Apple Inc. was notified of these security vulnerabilities and rectified them for the launch of iOS 7, acknowledging I²R’s and SMU’s contributions. Please see Appendix A for full information on the three security fixes developed by the I²R and SMU research team in iOS 7.

Dr Tan Geok Leng, Executive Director of the Institute for Infocomm Research (I²R) said, “I²R’s expertise in the infocomm security arena has once again been harnessed to benefit the mobile community. We are proud of our researchers’ efforts in boosting the security of Apple’s latest operating system – the iOS 7. The enhanced data protection, secured telephony functionality and protected Twitter functionality will let iOS end users utilise their mobile devices for leisure or work with a peace of mind.”

SMU’s Vice Provost of Research and Dean of the School of Information Systems Professor Steven Miller, said “Information security is a core area of research at the SMU School of Information Systems. Our research team not only aims to create impact in the research community, but also in the wider community. I am pleased to note that our researchers have been able to leverage our expertise and technologies to enhance security in cyberspace, and in this case help strengthen the security of the iOS platform to protect the security and privacy of businesses and individuals.”

[1]Source: App Store Tops 40 Billion Downloads with Almost Half in 2012 (January 2013), http://www.apple.com/sg/pr/library/2013/01/07App-Store-Tops-40-Billion-Downloads-with-Almost-Half-in-2012.html