Web Vulnerabilities in the Age of the iPhone
I’ve read lots of articles about hacking the iPhone lately. They’re mostly focused on exploring the hardware, circumventing the intended activation process, or putting new software on the device. That’s nice, and I like to see a technological marvel smashed open with a hammer just as much as the next geek, but I’m more interested in how the iPhone changes the balance of power when it comes to security.
Much more interesting is the way the iPhone connects the Web browser and the phone. As the author of a Web site, you can embed a telephone number in a web page like this:
<a id=”phone_home” href=”tel:1-900-867-5309″>call me!</a>
window.document.url = “tel:1-900-867-5309”
When that code runs, the user will be prompted “1-900-867-5309 (call) (cancel)”. If the user accepts, the phone dials. Now you can turn phishing into money faster than ever before because the payload is the product: victims dial a 900 number, and the money starts rolling in. By the way, setting up a 900 number is easy.
Alternatively, use a cross-site scripting vulnerability to have a banking Web site initiate a call to a fake technical support number. What’s the first thing the fake support rep asks for? Your account information of course! After all, you called them, so they need to “confirm your identity”. Once again, an old scam gets new legs with a little help from the latest technology, and once again the ante on cross-site scripting goes up.
I expect two things will happen in coming year:
1) We’ll learn about more cute tricks that web applications can use to look more like native iPhone applications and to interface with the iPhone and allow access to things like contacts, photos, and maybe even the phone’s physical location. All of these features will expand the horizons of enterprising attackers.
2) All of the other handset makers in the world will begin to deliver their response to the iPhone. At that point, they will all have been working around the clock in panic mode for the better part of a year, and the devices will contain a treasure trove of security vulnerabilities that make the iPhone look like Fort Knox. After all, Apple got plenty of things right: at least you have to confirm before the phone dials.