iOS update fixes glaring security hole

quote:

---

Apple Inc. has pushed an update for iOS mobile devices to close a gaping hole in its security software, which gave spies and hackers the ability of to grab e-mail, financial information and other sensitive data. An update for its Mac computers is reportedly coming “very soon.”

...The problem lies in the way the software recognizes the digital certificates used by banking sites, Google’s Gmail service, Facebook and others to establish encrypted connections. A single line in the program and an omitted bracket meant that those certificates were not authenticated at all, so that hackers can impersonate the website being sought and capture all the electronic traffic before passing it along to the real site.

In addition to intercepting data, hackers could insert malicious web links in real e-mails, winning full control of the target computer.

The intruders do need to have access to the victim’s network, either through a relationship with the telecom carrier or through a WiFi wireless setup common in public places. Industry veterans warned users to avoid unsecured WiFi until the software patch is available and installed.

The bug has been present for months, according to researchers who tested earlier versions of Apple’s software. No one had publicly reported it before, which means that any knowledge of it was tightly held and that there is a chance it hadn’t been used.

---