{"id":447,"date":"2008-10-06T08:37:05","date_gmt":"2008-10-06T07:37:05","guid":{"rendered":"http:\/\/blog.intego.com\/?p=447"},"modified":"2012-12-12T13:49:07","modified_gmt":"2012-12-12T21:49:07","slug":"two-iphone-security-flaws-made-public","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/","title":{"rendered":"Two iPhone Security Flaws Made Public"},"content":{"rendered":"<p>Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As <a href=\"http:\/\/www.macworld.co.uk\/ipod-itunes\/news\/index.cfm?RSS&#038;NewsID=23015\">Macworld UK reports<\/a>, the first bug is that the iPhone&#8217;s e-mail application automatically downloads images sent with messages. This can be used by spammers as a means of verifying whether a given address is active; if the image is downloaded, this confirms that the message has been received. <\/p>\n<p>While the first flaw is relatively minor (it may lead to being spammed more often), the second bug is more serious. It involves the way the iPhone displays URLs in e-mails. When messages are displayed in HTML mode, and they contain URLs, users can hover over the URL to see the link behind it; this can help weed out phishing attempts. But on the iPhone, the lack of screen space truncates the link&#8217;s URL. &#8220;An attacker could create a site with a long subdomain in order to fool a user into thinking it&#8217;s a legitimate site. In fact, a website designed to trick a person into revealing personal information, known as a phishing site, Raff said.&#8221;<\/p>\n<p><a href=\"http:\/\/feeds.feedburner.com\/~r\/AvivRaffOnnet\/~3\/408980568\/HappyNewYear.aspx\">Raff&#8217;s blog<\/a> shows an example of the phishing problem, and how long URLs can lead users to mistake the actual URLs of sites they visit.  <\/p>\n","protected":false},"excerpt":{"rendered":"<p>Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As Macworld UK reports, the first bug is that the iPhone&#8217;s e-mail application automatically downloads images sent with messages. This can be used by spammers as a means of verifying whether a given [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[7],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v17.4 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<meta name=\"description\" content=\"Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As Macworld\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Two iPhone Security Flaws Made Public - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As Macworld\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2008-10-06T07:37:05+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2012-12-12T21:49:07+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Peter James\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\",\"name\":\"Intego\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"sameAs\":[],\"logo\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#logo\"}},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#webpage\",\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/\",\"name\":\"Two iPhone Security Flaws Made Public - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#website\"},\"datePublished\":\"2008-10-06T07:37:05+00:00\",\"dateModified\":\"2012-12-12T21:49:07+00:00\",\"description\":\"Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As Macworld\",\"breadcrumb\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.intego.com\/mac-security-blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Two iPhone Security Flaws Made Public\"}]},{\"@type\":\"Article\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#webpage\"},\"author\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116\"},\"headline\":\"Two iPhone Security Flaws Made Public\",\"datePublished\":\"2008-10-06T07:37:05+00:00\",\"dateModified\":\"2012-12-12T21:49:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#webpage\"},\"wordCount\":218,\"publisher\":{\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#organization\"},\"articleSection\":[\"Apple\"],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116\",\"name\":\"Peter James\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/www.intego.com\/mac-security-blog\/#personlogo\",\"inLanguage\":\"en-US\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g\",\"caption\":\"Peter James\"},\"url\":\"https:\/\/www.intego.com\/mac-security-blog\/author\/peter\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"description":"Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As Macworld","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/","og_locale":"en_US","og_type":"article","og_title":"Two iPhone Security Flaws Made Public - The Mac Security Blog","og_description":"Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As Macworld","og_url":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/","og_site_name":"The Mac Security Blog","article_published_time":"2008-10-06T07:37:05+00:00","article_modified_time":"2012-12-12T21:49:07+00:00","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Peter James","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","sameAs":[],"logo":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo","inLanguage":"en-US","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#logo"}},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#webpage","url":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/","name":"Two iPhone Security Flaws Made Public - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"datePublished":"2008-10-06T07:37:05+00:00","dateModified":"2012-12-12T21:49:07+00:00","description":"Security researcher Aviv Raff has gone public regarding two iPhone security flaws, more than two months after he contacted Apple about them. As Macworld","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"Two iPhone Security Flaws Made Public"}]},{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#webpage"},"author":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116"},"headline":"Two iPhone Security Flaws Made Public","datePublished":"2008-10-06T07:37:05+00:00","dateModified":"2012-12-12T21:49:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/two-iphone-security-flaws-made-public\/#webpage"},"wordCount":218,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"articleSection":["Apple"],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/d0c16bd0a4dd8f82d91204f400c8d116","name":"Peter James","image":{"@type":"ImageObject","@id":"https:\/\/www.intego.com\/mac-security-blog\/#personlogo","inLanguage":"en-US","url":"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/0626bfb4ada576ba5aa775322329ad47?s=96&d=mm&r=g","caption":"Peter James"},"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/peter\/"}]}},"jetpack_featured_media_url":"","jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p4VAYd-7d","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/447"}],"collection":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=447"}],"version-history":[{"count":0,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/447\/revisions"}],"wp:attachment":[{"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=447"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=447"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/origin.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=447"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}