Of course, this could all just be nothing more than an innocent bug, as Adam Langley pointed out yesterday : Command, control and data exfiltration can occur over SMS messaging or a GPRS data connection.Ã‚Â All communications with the implant will be covert and encrypted.”īackdoors Found In Bitlocker, FileVault and TrueCrypt?

SMS retrieval, contact list retrieval, voicemail, geolocation, hot mic, camera capture, cell tower location, etc. DROPOUTJEEP, whose existence was revealed by Edward Snowden, targets the Apple iPhone ( but could conceivably be used on all other iOS devices) and allows the NSA to ' remotely push/pull files from the device. There is speculation that this could well be the security hole which the NSA exploited to insert the DROPOUTJEEP software implant, probably using automatic updates via SSL. As you can see, this flaw renders SSL in iOS and OS X utterly useless as an authentication process. As long as the masquerading website has a valid SSL certificate, Apple iOS and OS X will verify it as the correct website even though the SSL certificate name does NOT match the actual hostname. Normally, SSL prevents that by verifying that you are communicating with the correct website, but since Apple (inadvertently) forgot to validate the hostname, it doesn't actually verify the authenticity of the website, just the validity of the SSL certificate. This is a glaring flaw because it would allow anyone with a valid SSL certificate to masquerade as a trusted website to harvest your communications or login information.

It was specifically an SSL (Secure Socket Layer) vulnerability in iOS and OS X that exposes iOS and OS X devices to a 'man in the middle' attack.Īpparently, Apple used ' raw OpenSSL for HTTPS, but didn't include hostname verification'. On Friday, the 21st of February, Apple acknowledged that they had a critical security hole in their iOS operating system. ED#165 : Apple iOS And OS X Have A Critical Security Hole And The Fix Is Here

Whatsapp old version for ios 6.1.6