Israeli firm highlights 'mobileconfig' iOS vulnerability
An Israeli firm called Skycure Security has published a report that highlights a potential vulnerability threat to iOS. The report demonstrates how malicious users could circumvent Apple's malware protection via "mobileconfig" files.
As AppleInsider notes, "Mobileconfig files... are used by cellular carriers, Mobile Device Management solutions and some mobile applications to configure certain system-level settings for iOS devices, including WiFi, VPN, email and APN settings." Hackers could exploit a vulnerability in these provisioning profiles and get users to download the hacker's own custom profile and promise that it would give the user access to illegally streamed media from a certain website, for example. Once the malicious profile is on a user's iPhone, the hacker could route all that iPhone's data through their own server.
While this method of hacking a user's iPhone is only a proof of concept so far, Skycure Security recommends three rules of thumb when deciding to install mobileconfig provisioning profiles:
- You should only install profiles from trusted websites or applications.
- Make sure you download profiles via a secure channel (e.g., use profile links that start with https and not http).
- Beware of non-verified mobileconfigs. While a verified profile isn't necessarily a safe one, a non-verified should certainly raise your suspicion.
One security company raises awareness over malicious profiles on iOS
Subscribe to Newsletter
Software Updatesmore updates
- Viber announces Viber Out calls for iOS, goes head to head with Skype
- Amazon Cloud Drive Photos gains video, iPad support
- Pandora Radio 5.1: Wake up to your favorite station
- Microsoft revamps Bing for iPad
- Plex updated for iOS 7
- Readdle rolls out PDF Expert 5: iCloud support, shared folder with Documents by Readdle