Hasta La Gadget!

Apple claims that hundreds of thousands of iPhones are being used by corporations and government agencies. What it won’t tell you is that the supposedly enterprise-friendly encryption included with the iPhone 3GS is so weak it can be cracked in two minutes with a few pieces of readily available freeware.

“It is kind of like storing all your secret messages right next to the secret decoder ring,” said Jonathan Zdziarski, an iPhone developer and a hacker who teaches forensics courses on recovering data from iPhones. “I don’t think any of us [developers] have ever seen encryption implemented so poorly before, which is why it’s hard to describe why it’s such a big threat to security.”

With its easy-to-use interface and wealth of applications available for download, the iPhone may be the most attractive smartphone yet for business use. Many companies seem to agree: In Apple’s quarterly earnings conference call Tuesday, Apple chief operating officer Tim Cook said almost 20 percent of Fortune 100 companies have purchased 10,000 or more iPhones apiece; multiple corporations and government organizations have purchased 25,000 iPhones each; and the iPhone has been approved in more than 300 higher education institutions.

But contrary to Apple’s claim that the new iPhone 3GS is more enterprise friendly, the new iPhone 3GS’ encryption feature is “broken” when it comes to protecting sensitive information such as credit card numbers and social-security digits, Zdziarski said.

Zdziarski said it’s just as easy to access a user’s private information on an iPhone 3GS as it was on the previous generation iPhone 3G or first generation iPhone, both of which didn’t feature encryption. If a thief got his hands on an iPhone, a little bit of free software is all that’s needed to tap into all of the user’s content. Live data can be extracted in as little as two minutes, and an entire raw disk image can be made in about 45 minutes, Zdziarski said.

Wondering where the encryption comes into play? It doesn’t. Strangely, once one begins extracting data from an iPhone 3GS, the iPhone begins to decrypt the data on its own, he said.

To steal an iPhone’s disk image, hackers can use popular jailbreaking tools such as Red Sn0w and Purple Ra1n to install a custom kernel on the phone. Then, the thief can install an Secure Shell (SSH) client to port the iPhone’s raw disk image across SSH onto a computer.

To demonstrate the technique, Zdziarski established a screenshare with Wired.com, and he was able to tap into an iPhone 3GS’ data with a few easy steps. The encryption did not pose any hindrance.

Nonetheless, professionals using the iPhone for business don’t seem to care, or know, about the device’s encryption weakness.

“We’re seeing growing interest with the release of iPhone 3.0 and the iPhone 3GS due in part to the new hardware encryption and improved security policies,” Cook said during Apple’s earnings call. “The phone is particularly doing well with small businesses and large organizations.”

Clearly, the gigantic offering of iPhone applications is luring these business groups. Quickoffice Mobile, for example, enables users to access and edit Microsoft Word or Excel files on their iPhone. For handling transactions, merchants can use apps such as Accept Credit Cards to process a credit card on an iPhone anywhere with a Wi-Fi or cellular connection.

Several employees of Halton Company, an industrial equipment provider, are using iPhones for work, according to Lance Kidd, chief information officer of the company. He said the large number of applications available for the iPhone make it worthy of risk-taking.

“Your organization has to be culturally ready to accept a certain degree of risk,” Kidd said. “I can say we’ve secured everything as tight as a button, but that won’t be true…. Our culture is such that our general manager is saying, ‘I’m willing to take the risk for the value of the applications.’”

Kidd noted that Halton employees are not using iPhones for holding confidential customer information, but rather for basic tasks such as e-mailing and engaging with clients via social networking sites such as Facebook and Twitter. Halton also plans to code apps strictly for use at the company, Kidd said.

According to Kidd, a security expert performed an evaluation of Halton, and he said it was possible for any hacker to find an infiltration no matter the level of security. Therefore, Halton has measures in place to respond to an information security threat rather than attempt to avoid it.

“It’s like business continuity,” Kidd said. “You prepare for disasters. You prepare for if there’s an earthquake and the building breaks down, and you prepare for if there’s a crack in [information] security.”

But Zdziarski stands firm that the iPhone’s software versatility isn’t worth the risk for use in the workforce. He said sensitive information is bound to appear in e-mails or anything that can be contained on the iPhone’s disk, which can be easily extracted by thieves thanks to the new handset’s shoddy encryption.

Zdziarski said it’s up to the app developers to add an extra level of security to their apps because Apple’s encryption feature is so poor.

“If they’re relying on Apple’s security, then their application is going to be terribly insecure,” he said. “Apple may be technically correct that [the iPhone 3GS] has an encryption piece in it, but it’s entirely useless toward security.”

He added that the ability for the iPhone to self-erase itself remotely using Apple’s MobileMe service isn’t very helpful, either: Any reasonably intelligent criminal would remove the SIM card to prevent the remote-wipe command from coming through. (In a past Wired.com report, Zdziarski said the iPhone’s remote-wiping ability pales in comparison to Research In Motion’s BlackBerry, which can self-delete automatically after the phone has been inactive on the network for a preset amount of time.)

On top of that, the iPhone isn’t well protected in general usability, said John Casasanta, founder of iPhone development company Tap Tap Tap. He said though Apple’s approval process scans for malicious code, a developer could easily tweak the app to send a user’s personal data, such as his contacts list, over the network without his knowing.

“Apple can see if something is blatantly doing something malicious in the approval process, but it wouldn’t be very hard to do something behind the scenes,” Casasanta said.

Evidently, it isn’t difficult to sneak unauthorized content into the App Store. In May, Wired.com reported on an exploit demonstrated by the iPhone app Lyrics. Apple initially rejected the app because it contained profane words, and then Lyrics’ developer snuck the profanity into the app with a hidden Easter egg. Apple then approved the application.

Zdziarski added that there are other weaknesses with the iPhone: Pressing the Home button, and even zooming in on a screen, automatically creates a screenshot temporarily stored in the iPhone’s memory, which can be accessed later. And then there’s the keyboard cache: key strokes logged in a file on the phone, which can contain information such as credit card numbers or confidential messages typed in Safari. Cached keyboard text can be recovered from a device dating back a year or more, Zdziarski said.

Though Apple has declined to comment on iPhone security issues, the company has more or less admitted iPhones are vulnerable to security threats, because an emergency measure exists. In August 2008, Apple CEO Steve Jobs acknowledged the existence of a remote kill switch for iPhone apps, meaning if a malicious app made its way onto iPhones, Apple could trigger a command to delete the app from users’ devices. There is no evidence that the kill switch has ever been used.

So, what kind of business should you do with an iPhone if the device is not very secure? Zdziarski said there are some business-savvy apps that have managed to integrate better security (such as secure data fields to prevent key-stroke logging of credit card numbers, for example), but he warned companies to be cautious about investing too much trust in the iPhone and the apps available for it.

“We’re going to have to go with the old imperative of ‘Trust no one,’” he said. “And unfortunately part of that is, don’t trust Apple.”

See Also:

• Apple’s iPhone Security Gets Better, But Still Not BlackBerry …
• Massive iPhone Security Flaw Exposes Your Private Data – Here’s …
• Hacker Will Break iPhone Security on Video
• Apple Admits iPhone Security Flaw, Says Fix Coming in September …
• IPhone Can Take Screenshots of Anything You Do
• Help Wanted: iPhone Hacker for Apple

Photo: Jon Snyder/Wired.com

Just as we heard, Intel and Nokia have today announced a long-term partnership that just might / might not revolutionize the way you live. The all-too-mysterious release doesn’t go into great detail about what exactly the partnership will lead to, but it’s clear that the two are joining hands in order to “shape the next era of mobile computing.” Indeed, the duo has stated that they expect “many innovations to result from this collaboration over time” and they are hoping to “define a new mobile platform beyond today’s smartphones, notebooks and netbooks, enabling the development of a variety of innovative hardware, software and mobile internet services.” It’s hard to say if we’ll be seeing a Nokia UMPC, MID or smartbook in the near future, but we have to wonder if the world is even interested. An Intel-powered smartphone? Color us interested. An Intel-powered Nokiabook? Meh.

Filed under: Cellphones, Handhelds

Intel and Nokia officially partner on mobile devices: “the possibilities are endless” originally appeared on Engadget on Tue, 23 Jun 2009 11:54:00 EST. Please see our terms for use of feeds.

Read | Permalink | Email this | Comments

I took the Acer Aspire Timeline AS3810T (6415), recently reviewed by our laptop expert Cisco Cheng, for a spin and found it to be an affordable, ultra-thin laptop that can handle most tasks the average user could throw at it.

On the outside, the AS3810T is an attractive gray color with an aluminum-and-plastic frame. It may not be as tough as a MacBook Pro (I’ve accidentally dropped mine off of any type of furniture you could imagine, and it still manages to work fine), but for its $900 price tag, the system is built very well.

The only thing really missing from the machine is an optical drive, sacrificed for the sake of portability. For most users, however, this is far from being a deal-breaker, especially considering the built-in multifunction card reader and three USB ports.

It’s a truth that many open-minded observers have known for awhile now: Apple rules the roost in the portable media player market, and everyone else is just trying to keep up. Sorry, but it’s true. So true, in fact, that SanDisk‘s own CEO has finally come forward to admit it, recently stating in a Fortune interview that “you can’t out-iPod the iPod.” And believe us, such a statement probably wasn’t easy for Mr. Eli Harari to make. Remember, this is the same fellow that spent boatloads of dough on an “iDon’t” anti-iPod campaign back in 2006. ‘Course, SanDisk is still a (very distant) second place in the sector, and its flash memory is used in all manners of PMP devices. Still, it’s a huge relief to finally hear the mastermind behind slotMusic confess that he doesn’t actually believe such gimmicks will put it on a fast track to first place. Then again, crazier things have happened.

[Image courtesy of dnorton]

Filed under: Portable Audio, Portable Video

SanDisk CEO concedes: “You can’t out-iPod the iPod” originally appeared on Engadget on Thu, 04 Jun 2009 08:43:00 EST. Please see our terms for use of feeds.

Read | Permalink | Email this | Comments

Puny, lightweight netbooks are making their way into plenty of homes, but they must leap over a few hurdles before they become widely used in offices. First step: Convince the IT guys that the netbooks can handle the business and security needs of your company.

ZDNet polled a few Asian corporations who said they were experimenting with netbooks for their employees, and they raised a number of issues.

YCH Group, a logistics and supply company, said netbooks are suited to executive employees who are often on the road. However, the firm said it made major investments over three years to optimize business software to run well on the low-powered netbooks. Companies who haven’t done similar planning and investing will have a difficult time adopting netbooks due to performance and logistical issues, the company said.

Also, Hong Kong Jockey Club said it is only considering netbooks as an additional option for “non-business critical notebooks,” because netbooks are still aimed at consumers. Manufacturers must aim netbooks directly at business users with corresponding enterprise support and maintenance programs, the company said. Most netbooks ship with Windows XP Home, which lacks security features found in XP Pro or Vista, notes Liliputing’s Brad Linder.

At January’s Consumer Electronics Show in Las Vegas, many manufacturers, including HP, Sony and MSI were showcasing netbooks marketed for business use. The common hardware upgrade targeted at enterprise users was the addition of a 3G modem, which enables users to access the internet anywhere they can get a cellphone signal. Other than that, the business-oriented netbooks gained a more professional appearance than their consumer-oriented predecessors. ZDNet’s report suggests that, in order for netbooks to make it in the business world, manufacturers must address less visible areas as well — software and IT.

Netbooks making some enterprise headway in Asia [ZDNet via Liliputing]

See Also:

• Netbooks: An Accountant’s Best Friend?
• Tiny Notes Net Big Gains: The Netbook Revolution
• The Netbook Effect: How Cheap Little Laptops Hit the Big Time
• Cheap, Easy-to-Mod NetBooks Are a Hacker’s Paradise
• HP Says Its Netbook Is Business Class
• Puny, Trendy Netbooks Are Growing Up to Suit Business Users

Photo: Jon Snyder/Wired.com