Monday, July 11, 2011

Apple to Release iOS 4.3.4 to Patch JailbreakMe 3.0, PDF Vulnerability

Apple has confirmed plans to release an iOS update (likely designated iOS 4.3.4) soon with the purpose of patching a vulnerability that not only allows jailbreaks on its devices, but also opens the door to malicious hackers.

Jailbreak artist Comex has released JailbreakMe 3.0 this week with the purpose of enabling all iDevice owners, including iPad 2 users, to free their iOS-powered gadgets.

The hack leverages a vulnerability in the way iOS handles certain fonts in PDF files.

In a security bulletin issued recently, Germany’s Federal Office for Information Security has warned that opening a malicious PDF file “is sufficient to infect the mobile device with malware without the user’s knowledge.”

Security expert Graham Cluley, of Sophos, said the same thing but in different wording. Their advice is simple: don’t jailbreak!

In light of these events, Apple has reportedly confirmed that its software engineers are busy coding the next iOS software update with the purpose of patching said PDF hole.

Apple spokeswoman Bethan Lloyd has confirmed to the media today that the company is “aware of this reported issue and developing a fix that will be available to customers in an upcoming software update.”

Lloyd did not specify an exact release date for this new software release, but we can expect it to drop as soon as next week, given Apple’s ramped up efforts to thwart malware on its systems.

Recently, Apple has been faced with having to harden the security measures that keep OS X safe without the need of an antivirus application.

In Mac OS X 10.6.7, Snow Leopard, Apple introduced a tool that automatically updates known types of malware once every 24 hours.

iOS is still to be attacked by ‘malicious’ hackers (yes, there are also those who don’t act in bad faith), and we shouldn’t expect any security-centric features implemented in the next iOS update, or even iOS 5.

However, it’s only a matter of time before we hear of the first attacks targeting iPhones, and you can bet Apple will secure its iOS with twice the speed it did on the desktop front.