{"id":5985,"date":"2012-09-17T08:34:34","date_gmt":"2012-09-17T15:34:34","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=5985"},"modified":"2015-02-03T13:44:00","modified_gmt":"2015-02-03T21:44:00","slug":"apples-ios-6-release-a-mixed-bag-for-security-and-privacy","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/apples-ios-6-release-a-mixed-bag-for-security-and-privacy\/","title":{"rendered":"Apple’s iOS 6 Release a Mixed Bag for Security and Privacy"},"content":{"rendered":"

With Apple announcing the new iPhone 5<\/a>\u00a0last Wednesday, we now have the release date for the next version of iOS \u2013 September 19th<\/span>. There are a lot of new features (200, to be exact), some of which have some security and privacy concerns and some that have security improvements. Here’s a rundown of the most notable new iOS 6 features and their security\/privacy implications:<\/p>\n

iOS 6 Security Concerns<\/h3>\n

Passbook<\/strong>
\nWith the addition of Passbook in iOS 6, you\u2019ll now have tickets, gift cards, loyalty cards and coupons stored in one central location on your phone. What a wonderful boon for cybercrime! Personally identifying information, information about when you\u2019ll be out of the house, and potentially-resalable credit information will all be there for the taking. How long do you suppose it\u2019ll be before we see hacks of this discussed in BlackHat\/Defcon talks? I may be alone in this thought, but I was relieved to hear NFC is not being paired<\/a> with this yet. The two combined could have lead to some serious eavesdropping temptation.<\/p>\n

App Installation<\/strong>
\nThis is one feature that concerned me, though not greatly. In iOS 6, you will no longer have to input a password to install free apps. It\u2019s a fairly minor concern, but it\u2019s worth noting. We\u2019ve not yet seen malicious iOS apps in the wild for non-jailbroken phones. And with the granular permissions that iOS 6 is adding, it would be that much harder for malware authors to gain access to your device and then exfiltrate anything of value. But on the other hand, the introduction of Passbook does increase the value for malware authors who go to that trouble. For me, the biggest concern is security training \u2013 if people are used to apps installing without using a password, people will be unfazed by apps appearing on their screen without having to give explicit permission.<\/p>\n

iOS 6 Security Strengths<\/h3>\n

Kernel Address Space Layout Randomization<\/strong>
\nThe name alone is a mouthful of gibberish for a lot of folks. But from a security perspective, this is perhaps the most exciting feature of iOS 6. And it\u2019s not just hard to say \u2013 it\u2019s also hard to explain to the average user, and so it\u2019s the least likely to be explained in feature lists. Here\u2019s the short of it: there are certain data structures within the OS that allow hackers to exploit vulnerabilities in the operating system if they can get access to them. In iOS 6, these addresses are not static \u2013 they change periodically. So hackers can no longer use some of the most common methods for breaking into software. This means it will take a whole lot more skill and effort to come up with a jailbreak that works for iOS 6 (whether you consider that a good or a bad thing), and it also means it\u2019ll be harder for malware authors to sneak onto non-jailbroken machines. That alone may be enough to mitigate any benefit to cyber criminals, from the two features above.<\/p>\n

More Granular Privacy Controls
\n<\/strong>There has been a lot of press about apps gathering information<\/a> that is not immediately obvious, and iOS 6 has put warnings in place to help make apps actions more transparent. Their new, more granular privacy notifications require apps to gain your permission before requesting access to your location, contacts, calendars, reminders, or photos. This should go a long way towards making people feel more secure about using apps, which is particularly timely given the recent report from the Pew Research Center<\/a>\u00a0which found that 57% of all app users either have declined to install or have uninstalled an app over privacy concerns.<\/p>\n

All in all, this new version of iOS looks to be the most secure version yet. From a trickster perspective, it looks like the ongoing battle between jailbreakers and Apple has actually done amazing things in terms of improving devices\u2019 overall security. Now that Apple is also giving us more view into the actions of legitimate apps as well as trying to keep out unauthorized code, we should be able to breathe a little easier about the security of our data.<\/p>\n

Are you planning on updating your iDevices to iOS6? Which features are you most looking forward to? Do you think the security features in the newest OS will be helpful or an unnecessary hurdle?<\/p>\n","protected":false},"excerpt":{"rendered":"

With Apple\u2019s big reveal this previous Wednesday, we now have the release date for the next version of iOS \u2013 September 19th. There are a lot of new features, but there are a few that got less attention, which pertain to security and privacy. For the most part, these features improve security and give you more granular control over your privacy.<\/p>\n","protected":false},"author":6,"featured_media":5989,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"spay_email":"","jetpack_publicize_message":"","jetpack_is_tweetstorm":false},"categories":[7,13],"tags":[],"yoast_head":"\n\n\n\n\n\n\n\n\n\n\n\n\n\t\n\t\n\n\n\t\n\t\n\t\n