Are Apple's Security Measures Sufficient to Protect Its Mobile
Total Page：16
File Type：pdf, Size：1020Kb
Are Apple’s Security Measures Sufficient to Protect Its Mobile Devices? Galen A. Grimes Department of Information Sciences and Technology Penn State University – Greater Allegheny Campus McKeesport, PA, USA [email protected] Abstract—Apple Computer’s iPad tablet computer 2011 Apple had sold more than 25 million iPads has taken a commanding lead in the tablet market worldwide making it the undeniable leader in the and history has shown that whenever a computer tablet market [4]. platform becomes dominant, it also becomes a target for malicious intruders and malware. Apple The iPad runs the iPhone Operating System computers have long been touted as being safer (iPhone OS, or simply iOS) which enables it to from malware than their Windows counterparts, likewise run the more than 550,000+ available largely because of their smaller market share. This iPhone applications (called “apps” for short) in paper examines the current state of security for the addition to the more than 140,000+ apps iPad and mobile devices running Apple’s iPhone designed specifically for the iPad with its larger Operating System. Does the iPad have any vulnerabilities that need to be addressed by Apple, screen and more powerful processor. Missing for or is it as safe and malware-proof as some Apple a long time, however, from this mega-catalog of devotees attest? utilities, productivity apps, and games are two apps that most security experts would deem Keywords-iPad; iPhone; malware; mobile essential on any other computer system: an devices; security; antivirus app and a firewall app. The first of I. INTRODUCTION these gaps was filled in July of 2011 when the security vendor Intego released VirusBarrier iOS Apple has long touted its seemingly for the iPhone, iPod, and iPad, making it the first invulnerability to malware on both of its anti-virus app for Apple mobile devices [5]. platforms—Mac OS X and iPhone Operating System. The debate on the invulnerability of the The VirusBarrier app is not a full-featured Mac OS X platform has two major camps. The application like you might utilize on your first faction contends that Mac OS X is based on desktop or laptop; but it will allow you to an inherently superior software design than manually scan files in email attachments and Microsoft Windows, and this superior design files imported to your mobile device via makes it more resistant to malware [1]. This DropBox. It will also allow you to manually scan group also largely dismisses the contention of files on web sites you frequent, your iDisk in the other faction, which contends that virus your MobileMe account, and FTP or WebDAV writers haven’t targeted Macs because Apple sites. lacks market-share. The argument from the other camp goes that Windows dominates the But there is still little reason for most iOS users worldwide PC market with Windows operating to worry about malware. To date, only five iOS on roughly 90-95% of all personal computers pieces of malware have been identified ever [6] and thus virus writers get more "bang for their [7]. buck" by going after the "largest fish in the Even though Apple’s mobile products still lack a ocean" [2]. firewall app, Mac OS X since its inception has If you agree with the market share argument, included a firewall and numerous third-party then Apple seemingly has created a new target vendors have created and successfully promoted for malicious hackers. The Apple iPad in its first antivirus/security software for the Mac OS X two months took a commanding lead in the tablet platform, such as Symantec, McAfee, Sophos, computer race selling more than 2 million units and Intego even though very few verifiable [3]. Apple exceeded sales predictions in 2010 by pieces of malware have been identified including selling more than 10 million iPads. By June of 978-1-4577-0580-9/12/$26.00 ©2012 IEEE a report last year about malicious spyware found security researchers reported today. in a third party screensaver [8]. According to U.K-based antivirus vendor Sophos and U.S. Mac security company Intego, Mac OS X Some security experts still recommend using 10.6.4, which Apple released this past Tuesday, antivirus/security software on Mac OS X to includes an update to XProtect. prevent Macs from becoming carriers and Dubbed that because the malware signatures are spreaders of malware even if they are impervious contained within Snow Leopard's "XProtect.plist" to the mostly Windows-based malware [9]. Macs file, the feature debuted in August 2009 with the are still able to forward emails containing launch of Mac OS X 10.6. At the time, Apple included detection for only two pieces of malware, malware without themselves becoming infected. Trojan horses named "RSPlug.a" and "Iservice" by From a design perspective, Mac OS X and iOS Symantec [11]. are in a much better position to fend off malware Apple developers use the same “sandboxing” than Windows. Apple maintains a much more memory management techniques to control closed and controlled hardware and software program and data access inside iOS as explained environment with Mac OS X and iOS than does in the iPhone Application Programming Guide. Microsoft with its Windows OS. While For security reasons, iPhone OS restricts an Windows is designed to run on a seemingly application (including its preferences and data) to endless array of hardware devices, i.e., PCs, a unique location in the file system. This netbooks, smartphones, etc., from an equally restriction is part of the security feature known as endless number of vendors, Mac OS X and iOS the application’s “sandbox.” The sandbox is a set of fine-grained controls limiting an application’s operate on a very small and tightly controlled list access to files, preferences, network resources, of hardware devices all controlled by Apple. hardware, and so on. In iPhone OS, an application and its data reside in a secure location that no other application can access. [12]. II. APPLE’S SECURITY DESIGN However, the developers warn that the iOS Apple’s approach to security is as controlled as sandbox does not provide absolute protection its closed hardware environment. Within Mac against attackers. OS X, Apple uses a protected memory The sandbox limits the damage an attacker can environment that its developers call cause to other applications and to the system, but it cannot prevent attacks from happening. In other “sandboxing”. words, the sandbox does not protect your With virtually no effort on your part, Mac OS X application from direct attacks by malicious offers a multilayered system of defenses against entities. For example, if there is an exploitable viruses and other malicious applications, or buffer overflow in your input-handling code and malware. For example, it prevents hackers from you fail to validate user input, an attacker might harming your programs through a technique still be able to crash your program or use it to called “sandboxing” — restricting what actions execute the attacker’s code [13]. programs can perform on your Mac, what files they can access, and what other programs they can Attacks against Apple’s Mac OS X security launch. Other automatic security features include posture are not merely centered on whether the Library Randomization, which prevents malicious OS is vulnerable to malware. The hacker group commands from finding their targets, and Execute that launched the attack against AT&T revealing Disable, which protects the memory in your Mac from attacks [10]. the email addresses of more than 100,000 iPad owners has also revealed security flaws in the In a nutshell, Apple developers have isolated Safari Web browser, which is installed on both operations in the OS to prevent one program and Mac OS X and iOS. its associated data from accessing another According to [Escher] Auernheimer, Goatse program and its associated data, thus providing Security released an overflow exploit for Safari built-in protection against malware. As secure as back in March. Apple patched the vulnerability this model appears, Apple developers are still for the desktop, but not for the iPad: "This bug we aware that it is not totally bulletproof and include crafted allows the viewer of a Web page to become a proxy (behind corporate and code to protect against malware. In June of 2011 government firewalls!) for spamming, exploit Apple developers quietly added additional anti- payloads, password bruteforce attacks, and other malware code to Snow Leopard (Mac OS X undesirables. The kicker is that this attack cannot 10.6.x). be detected by any current IDS/IPS system. We released this in March, mind you, and Apple still Ten months after it debuted rudimentary malware hasn't got around to patching this on the iPad!" scanning in Snow Leopard, Apple this week quietly Auernheimer wrote [14]. added a signature for a third piece of malware, 978-1-4577-0580-9/12/$26.00 ©2012 IEEE But the biggest concern about Apple’s security or patching, the iBoot and operating system vulnerability involves iPhones and iPads where kernel in this process, rendering them unable to do the digital signature checks that evaluate and the users have run software to “jailbreak” the distinguish authorized or unauthorized software devices. [16]. The iPad was actually jailbroken using a fairly lengthy process, which involves replacing plists III. THE JAILBREAKING SECURITY DILEMMA [property lists] on the device using replacement of files using a loosely checked backup over USB Jailbreaking is the term used to describe iPhones process. Carefully crafted files can be placed on and iPads in which the users have run software the filesystem that are run and the outcome is that to modify the operating system.