HTTP Secure

Apple App Store Unsecure

March 21st, 2013

In a statement by Google security researcher Elie Bursztein, Apple’s App Store servers didn’t encrypt all the communications with iOS clients, which left users exposed to several potential cyber attacks until late January.

In a blogpost on Friday, Bursztein said that, “The Apple App Store and associated applications, such as the Newsstand, are native applications provided by default with iOS to access and/ or purchase content from the Apple App Store”. He concluded, “While the Apple App Store is a native iOS app, most of its active content, including app pages and the update page, is dynamically rendered from server data.” For the purpose of infusing rogue content into applications, network attackers might have exploited lack of HTTPS (HTTP secure) encryption for specified parts of the communication between Apple’s App Store iOS clients and the servers, he said. With this technique, attackers aim to trick apple users into password exposure by infusing fake password into the App Store app, which in turn force users to install and buy rogue applications with alteration in purchase parameters on the fly, trick users into installing rogue apps by passing them as updates for already installed apps, prevent the users from upgrading and installing specific apps, or check what apps they have already installed on their devices.

When the tech giant enabled HTTPS for app store active content by default, such attacks were possible until Jan 23. Later, the Apple, figured out the change itself in support listing that fixes on its websites and two other researchers along with Bursztein, credited with reporting issues. It is happening because of the fact that users devices’ are not protected with data encryption software which is vital for any device that feeds on technology. So there it calls for a data security.

Google researcher claims to have reported about the cyber attacks to Apple early in July, last year. “I am really happy that my spare-time work pushed Apple to finally enabled HTTPS to protect users,” he said. he also emphasized on using data encryption software.

Like most of the cyber attacks scenarios which are exploiting the data security as well as the lack of full-session HTTPS on websites, the cyber attacks on App Store found by Bursztein could have been easily executed against iOS users who connects to public Wi-Fi networks like those who are found in airports, coffee shops, libraries, filling stations and other public spaces, by encryption process

The researcher interpreted all those cyber attacks in detail in his blog post. Precisely, he also published few video demonstrations for the clients in general, as well as the users, on YouTube showing how the cyber attacks would have appeared to targeted iOS users.

He said, “I decided to render all those attacks public, in hope that it will lead more developers (in particular mobile ones) to enable HTTPS,”. “Enabling HTTPS and ensuring certificates validity is the most important thing you can do to secure your app communication.” Before doing so, always keep data security in mind.

During past few years, major Internet giants like Facebook, Google, and Twitter enabled always-on HTTPS in order to ensure users’ data security for their on-line services.

Paul Ducklin, the head of technology at Sophos (Asia-Pacific) told in a blog post on Saturday, “Apple, it seems, didn’t bother with HTTPS everywhere, even for its own App Store, until 2013,”. “Since there’s no other place to shop when you’re buying or selling iDevice software, and since Apple likes it that way, you might think that Cupertino would have set the bar a bit higher.”

Get your personal as well as office laptops encrypted by Alertsec

Unencrypted laptops present a major risk of data loss. 80% of information theft is due to lost or stolen laptops and other equipment. About 50% of network intrusions are performed with credentials gathered from lost or stolen devices. The penalties for a data breach are severe not only in terms of the monetary fines imposed on the organization, but also the potential loss of trust from customers and suppliers. Encryption software greatly enhances the security of your organization’s data as the information is not compromised if a laptop is lost or stolen.

Alertsec Xpress is the full disk encryption service that delivers a mobile data protection system for all information stored on laptops used throughout your organization.

Enhanced by Zemanta