{"id":7142,"date":"2016-05-06T04:31:35","date_gmt":"2016-05-06T08:31:35","guid":{"rendered":"https:\/\/kasperskydaily.com\/uk\/?p=7142"},"modified":"2022-10-20T17:12:29","modified_gmt":"2022-10-20T16:12:29","slug":"iphone-vulnerabilites","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/iphone-vulnerabilites\/7142\/","title":{"rendered":"Vulnerabilities in the iPhone"},"content":{"rendered":"<p>iPhone users are notorious for their slight indulgence towards those who prefer alternative platforms. Android is constantly under attack by malware and Trojans, they say, while iOS is immune to threats. Is it really <i>that<\/i> secure as Apple fans see it?<\/p>\n<p>The answer is: no, it isn\u2019t. In this article we will discuss several types of attacks which are as bad for the iPhone\u2019s as they are for other devices.<\/p>\n<h3>Phishing<\/h3>\n<p>Phishing attacks target \u2018what\u2019s between a chair and a keyboard,\u2019 meaning the users themselves. Phishers typically prey on human carelessness or a lack of overall awareness of security issues.<\/p>\n<p>It might seem as if the attributes of a phishing attack are known to everyone. But lest we forget that newbies join Internet day by day in great numbers, and they are not necessarily aware of the tricks that cyber-criminals try to play on them. On the other hand, cyber-criminals do not sit idle; they invent new tricks every day.<\/p>\n<p>If there is slightest doubt that the website you are on is not legitimate (for instance, the questions asked by your online banking tool are different from those you are used to), don\u2019t push your luck and contact the support team right away. Better safe than sorry, otherwise you are running a high chance of battling for your hard-earned money later.<\/p>\n<p><b>Means of protection:<\/b> Read through our <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/phishing-ten-tips\/6452\/\" target=\"_blank\" rel=\"noopener\">recommendations<\/a> on how to identify fake web pages. A great deal of help might come from the <a href=\"https:\/\/app.appsflyer.com\/id1089969624?pid=smm&amp;c=uk_kasperskydailyplaceholder\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky for iOS<\/a>, which is specifically designed to spot phishing websites.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">10 Tips to protect yourself from <a href=\"https:\/\/twitter.com\/hashtag\/Phishing?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Phishing<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ITEducation?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ITEducation<\/a> <a href=\"https:\/\/t.co\/gg888NWSmQ\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/gg888NWSmQ<\/a> <a href=\"https:\/\/t.co\/XxPwFLz8bf\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/XxPwFLz8bf<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/665208665125842944?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">November 13, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<h3>Public Wi-Fi<\/h3>\n<p>There is another method of attacking your device regardless of its platform \u2014 via Wi-Fi. Internet has become ubiquitous, however, public wireless networks might pose a real danger to users.<\/p>\n<p>Any attempt to access world wide web through a suspicious hotspot can result in compromised passwords and loss of personal data. Be careful and watch your back, no matter what smartphone you use.<\/p>\n<p><b>Means of protection:<\/b> If you decided, nevertheless, to use a public Wi-Fi hotspot, follow <a href=\"https:\/\/www.kaspersky.com\/blog\/dangerous-public-wi-fi\/10774\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">these simple rules<\/a> : avoid unprotected hotspots, use secure channel (HTTPS) and disable automatic connection to Wi-Fi in your iPhone settings.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-7143\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2016\/05\/05193843\/ios-wifi-settings-EN.png\" alt=\"ios-wifi-settings-EN\" width=\"577\" height=\"1024\"><\/p>\n<h3>Malware<\/h3>\n<p>A sad fact: the time when the iPhone was almost free from the risk of malware, are long gone.<\/p>\n<p>Most often, malware targets jailbroken devices (devices which provide system-level access in order to unlock more functions). The most common reason for a user to jailbreak their phone is to run pirated or illegitimate apps and overcome certain limitations imposed by iOS.<\/p>\n<p>Weaker security is the downside of these additional opportunities, and it\u2019s no wonder: when you make a \u2018hole\u2019 in a \u2018fence\u2019 built by Apple developers, don\u2019t be surprised when something suspicious sneaks in.<\/p>\n<p>But even if you don\u2019t jailbreak your device, iPhone cannot be totally secure. Even very rigid control from Apple App Store experts does not always keep malicious apps from finding ways into your device. Hackers can find alternative methods to compromise it.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Trojan Exploits Apple DRM Flaw, Plants <a href=\"https:\/\/twitter.com\/hashtag\/Malware?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Malware<\/a> On Non-Jailbroken <a href=\"https:\/\/twitter.com\/hashtag\/iOS?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iOS<\/a> Devices: <a href=\"https:\/\/t.co\/n5MHIRbOn7\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/n5MHIRbOn7<\/a> <a href=\"https:\/\/t.co\/SluytGnjmJ\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/SluytGnjmJ<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/710219381712801793?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 16, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>There was a real case when adversaries <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/xcodeghost-compromises-apps-in-app-store\/\" target=\"_blank\" rel=\"noopener\">managed to compromise dozens of third-party apps<\/a> using a malicious Xcode SDK. The infected SDK was distributed in the Chinese sector of the Internet and was quite popular: people behind the \u2018Great Chinese Firewall\u2019 found it too challenging to download a heavy file from Apple\u2019s official website.<\/p>\n<p>Another example: once hackers persuaded users into downloading free apps from App Store, without a jailbreak. Simultaneously, the culprits installed malicious applications , and stole Apple IDs from the compromised devices.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/AceDeciever?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#AceDeciever<\/a>: the malware that can infect ANY <a href=\"https:\/\/twitter.com\/hashtag\/iPhone?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iPhone<\/a> <a href=\"https:\/\/t.co\/CHGxuR5J3D\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/CHGxuR5J3D<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/iOS?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iOS<\/a> <a href=\"https:\/\/t.co\/GS7TkekjGB\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/GS7TkekjGB<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/715548622490902529?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">March 31, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>It\u2019s obvious that, like in case of other platforms, malware targeting iPhone is frequently bundled with digital piracy. Just think twice before you decide to take advantage of something \u2018entirely free.\u2019<\/p>\n<p>Means of protection: We recommend that you do not jailbreak your devices. When the firmware is compromised, there is a fair chance you\u2019ll become a target for cyber-criminals. On the other hand, when it comes to the update routine, don\u2019t hesitate to install them: official updates are designed to make your device more secure.<\/p>\n<h3>Apple ID hijacking<\/h3>\n<p>In the Apple world, you cannot get anywhere without an Apple ID. It is a single pass to your user profile, iCloud service, and the company\u2019s online marketplace. Apple ID means access to many domains of your digital life, so no wonder adversaries frequently target Apple IDs.<\/p>\n<p>There are different ways to hijack Apple ID: via a malicious app on the smartphone, via phishing and also by compromising a computer that is used to access iCloud and other Apple services.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">7 <a href=\"https:\/\/twitter.com\/hashtag\/iPhone?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iPhone<\/a> Apps for your Security <a href=\"http:\/\/t.co\/lFNTv8RxLM\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/lFNTv8RxLM<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/FindMyiPhone?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#FindMyiPhone<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/iOS?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#iOS<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/458250517022769152?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">April 21, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>To protect your Apple ID from criminals, use two-factor authentication. Once it\u2019s enabled, all attempts to access Apple service would require a one-time password which would be sent to a trusted device. This would significantly lower the chances of an outsider using a leaked or stolen password.<\/p>\n<p>Another thing that we need to mention is that you should not share an Apple ID with multiple people. While this is not uncommon with close friends or relatives, a shared account creates more opportunities to be compromised. Friendship is sacred, but passwords and accounts <a href=\"https:\/\/www.kaspersky.co.uk\/blog\/passwords-are-like-underwear\/6484\/\" target=\"_blank\" rel=\"noopener\">should be used separately<\/a>.<\/p>\n<p><b>Means of protection:<\/b> <a href=\"https:\/\/support.apple.com\/en-us\/HT204915\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">enable two-factor authentication for Apple ID<\/a>, if you have not done so yet.<\/p>\n<p>Finally, some tips for those who wish to be confident about their device security:<\/p>\n<p>\u2022 Enable the \u2018Find My Phone\u2019 feature: it provides a chance to find a lost or stolen smartphone. Even if you are not able to bring your device back, at least you can lock it or wipe your personal data.<\/p>\n<p>\u2022 Use a strong password to unlock your phone: make sure you create it using numbers, letters and special characters. The latest iPhone models employ a fingerprint scanner called Touch ID to authenticate a user.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apple iPhone users tend to think their device is absolutely secure. We will take you through several types of attacks which usually target Apple\u2019s smartphones.<\/p>\n","protected":false},"author":1654,"featured_media":7144,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2026,9],"tags":[2412,14,1457,26,76,97],"class_list":{"0":"post-7142","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"category-tips","9":"tag-advice","10":"tag-apple","11":"tag-apple-id","12":"tag-iphone","13":"tag-phishing","14":"tag-security-2"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/iphone-vulnerabilites\/7142\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/iphone-vulnerabilites\/7107\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/iphone-vulnerabilites\/7080\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/iphone-vulnerabilites\/8265\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/iphone-vulnerabilites\/8119\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/iphone-vulnerabilites\/11808\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/iphone-vulnerabilites\/12009\/"},{"hreflang":"fr","url":"https:\/\/www.kaspersky.fr\/blog\/iphone-vulnerabilites\/5602\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/iphone-vulnerabilites\/6225\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/iphone-vulnerabilites\/7607\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/iphone-vulnerabilites\/11281\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/iphone-vulnerabilites\/11808\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/iphone-vulnerabilites\/12009\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/iphone-vulnerabilites\/12009\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/advice-2\/","name":"advice"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/7142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/1654"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=7142"}],"version-history":[{"count":6,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/7142\/revisions"}],"predecessor-version":[{"id":25123,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/7142\/revisions\/25123"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/7144"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=7142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=7142"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=7142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}