#hacking iphone

By Cyra Master, The Hill, April 17, 2016

“60 Minutes” correspondent Sharyn Alfonsi traveled to Berlin, where she interviewed a team of hackers who are looking for vulnerabilities in mobile phone systems so they can warn the public of the risks they face.

The program sent an iPhone to Rep. Ted Lieu (D-Calif.), a member of the House Oversight and Reform Subcommittee on Information Technology, who agreed to use it knowing it would be hacked.

The results were startling.

As soon as the hackers had the phone number, they accessed a flaw in a vital global network that connects phone carriers and accessed nearly everything in his phone. They were able to listen to and record calls, view his contacts and track his movements.

When the program played the lawmaker a recording of a phone call he had with a staffer, he had two reactions.

“First, it’s really creepy. And second, it makes me angry,” he said.

“They could hear any call of pretty much anyone who has a smartphone. It could be stock trades you want someone to execute. It could be calls with a bank. … Last year, the president of the United States called me on my cellphone. And we discussed some issues. So if the hackers were listening in, they would know that phone conversation. And that’s immensely troubling.”

Hacker John Hering, who cofounded the mobile security company Lookout, said the average person isn’t going to be targeted by such extreme attacks.

“But our goal was to show what’s possible. So people can really understand if we don’t address security issues, what the state of the world will be.”

The hackers created a “ghost” version of the hotel Wi-Fi and had Alfonsi connect--a process called “spoofing.” They immediately gained access to her email and pulled her credit card information, phone number and records about her movements from her ride-sharing apps. They also showed how they could take control of the camera on her phone and use it to broadcast a live video stream from the phone.

The genie is now out of the bottle. “Legally” cracking iPhone and iPad’s is a thing. 

Hackers WIN $1 Million Bounty for Remotely Hacking latest iOS 9 iPhone

Well, here’s some terrible news for all Apple iOS users… Someone just found an iOS zero-day vulnerability that could allow an attacker to remotely hack your iPhone running the latest version of iOS, i.e. iOS 9. Yes, an unknown group of hackers has sold a zero-day vulnerability to Zerodium, a startup by French-based company Vupen that Buys and Sells zero-day exploits. And Guess what, in How much?…

Apple told Judge: It’s Impossible to Access Data on Locked iPhones

US Federal Official: Unlock that iPhone for me? Apple: Sorry, Nobody can do this! Neither we, nor you. Yes, in a similar manner, Apple told a U.S. federal judge that it is “IMPOSSIBLE” to access data stored on a locked iPhone running iOS 8 or later iOS operating system. In short, Apple has reminded everyone that the tech giant can not, and will not, break its users’ encryption if the government…

YiSpecter — First iOS Malware that Attacks both: Non-jailbroken and Jailbroken Devices

Less than a month after Apple suffered one of its biggest malware attacks ever, security researchers have discovered another strain of malware that they claim targets both jailbroken as well as non-jailbroken iOS devices. Last month, researchers identified more than 4,000 infected apps in Apple’s official App Store, which was targeted by a malware attack in which some versions of software used by…

New Post has been published on http://uvideoz.com/yispecter-first-ios-malware-that-attacks-both-non-jailbroken-and-jailbroken-devices/

YiSpecter — First iOS Malware that Attacks both: Non-jailbroken and Jailbroken Devices

Less than a month after Apple suffered one of its biggest malware attacks ever, security researchers have discovered another strain of malware that they claim targets both jailbroken as well as non-jailbroken iOS devices.

Last month, researchers identified more than 4,000 infected apps in Apple’s official App Store, which was targeted by a malware attack in which some versions of software used by developers to build apps for iOS and OS X were infected with malware, named XcodeGhost.

And Now:

Researchers from a California-based network security firm Palo Alto Networks have discovered new malware that targets Apple’s iOS users in China and Taiwan.

Capabilities of YiSpecter Malware

Dubbed YiSpecter, the malware infects iOS devices and once infected, YiSpecter can:

Install unwanted apps

Replace legitimate apps with ones it has downloaded

Force apps to display unwanted, full-screen ads

Change bookmarks as well as default search engines in Safari

Send user information back to its server

Automatically reappears even after a user manually deletes it from the iOS device

It is still unclear how many users have been or could be infected by YiSpecter, but according to the researchers, this first instance of iOS malware targeting and succeeding in infecting non-jailbroken iOS devices has been around since November 2014.

“Whether an iPhone is jailbroken or not, the malware can be successfully downloaded and installed,” the researchers wrote in a blog post on Monday. “Even if you manually delete [YiSpecter], it will automatically re-appear.”

YiSpecter targets jailbroken as well as non-jailbroken iOS devices by abusing private APIs to allow its four components that are signed with enterprise certificates to install from a centralized command and control server.

Three of the four malicious components can be used to hide their icons from iOS SpringBoard – the standard app that runs the home screen – and also disguise themselves with the same name and logos of system applications to escape detection from users.

Vectors of YiSpecter malware

According to researchers, YiSpecter malware has been targeting Apple’s iOS devices for over 10 months, when it was first spread by disguising as an app that lets users watch free porn.

The app was advertised as a private version of a famous media player “QVOD” – a popular video streaming app developed by Kuaibo(快播) to share porn videos.

The malware then infected more devices through:

Hijacked Internet traffic from ISPs

A Windows worm that first attacked the Tencent’s instant messaging service QQ

Online communities where people install third-party applications in exchange for promotion fees from app developers

Security researchers from Palo Alto Networks have already reported the latest YiSpecter malware to Apple, which says “they are investigating” the issue.

How to Remove YiSpecter from Your iOS Devices?

For iOS users who are potentially infected by YiSpecter should follow the below four-step process to remove the malware from your devices:

Head on to Settings –> General –> Profiles and remove all unknown or untrusted profiles.

Delete any installed apps with names 情涩播放器, 快播私密版 or 快播0.

You can use any third-party iOS management tool such as iFunBox on Windows or Mac OS X to connect with your iPhone or iPad

Then check for installed iOS apps like Phone, Weather, Game Center, Passbook, Notes, or Cydia and delete them. (Note: this will not affect original system apps but just delete the fake malware apps)

Latest iOS 9.0.1 Update Failed to Patch Lockscreen Bypass Hack

iOS 9.0.1 – Apple’s first update to its new iOS 9 mobile operating system, came out on Wednesday, addressed several bugs in its software. However, unfortunately, it seems that the latest update iOS 9.0.1 doesn’t fix the lock screen bypass vulnerability reported by iPhone user Jose Rodriguez. Yes, the serious flaw in iOS 9 that allows anyone – with physical access of your iPhone or iPad – to…

New Post has been published on http://uvideoz.com/latest-ios-9-0-1-update-failed-to-patch-lockscreen-bypass-hack/

Latest iOS 9.0.1 Update Failed to Patch Lockscreen Bypass Hack

iOS 9.0.1 – Apple’s first update to its new iOS 9 mobile operating system, came out on Wednesday, addressed several bugs in its software.

However, unfortunately, it seems that the latest update  doesn’t fix the lock screen bypass vulnerability reported by iPhone user Jose Rodriguez.

Yes, the serious flaw in iOS 9 that allows anyone – with physical access of your iPhone or iPad – to bypass your device’s lock screen and get into your contacts and personal photographs, also Works on iOS 9.0.1.

Video Demonstration:

Rodriguez published a new video detailing a step-by-step explanation on how to bypass the passcode on iOS 9 and iOS 9.0.1 device, using the benevolent nature of Apple’s personal assistant Siri.

The lock screen bypass vulnerability works on all iOS versions from iOS 5.1.1 to the latest released iOS 9.0.1.

Mitigation

So, until Apple rolls out an update to patch this bug, the only way available to iPhone users to mitigate the issue is to disable Siri from being accessed from the lock screen.

To disable Siri on the lock screen, follow these simple steps:

Go to Settings

Select Touch ID & Passcode

Enter your passcode in the prompt

Look for “Allow access when locked” section and Disable Siri

The iOS lock screen bug is similar to that fixed in the latest version of Android Lollipop. The Android lock screen bypass bug was far more complex than the current iOS bypass, as well as the impact was also worse.

The Android lock screen bypass gave attackers access to all important files as well as the ability to install malicious apps on the affected device.