By the day after release of Apple’s new iPad 3, hackers had already found three ways to jailbreak the OS of the tablet device. This represented a drop of six days compared to the time necessary for jailbreaking the iPad 2 after launch.

Hackers also dryly noted that out of Apple’s entire device lineup, the best-protected device is also the very cheapest one: the Apple TV 3.1 television appliance.

Why? Most of the features in Apple’s iOS operating system, which is used on all of the company’s mobile devices, are simply discarded and disabled on the Apple TV. This reduces the “area for attack” available to hackers, thus creating significant obstacles for them.

Although the newer version of the Apple TV was ultimately hacked nonetheless, the jailbreak tool did not catch on with users. It is usually the case that Apple gradually updates the operating system with the features that users had hoped to gain through jailbreaking their devices.

According to a research called “The Impact of Mobile Devices on Information Security” published by Check Point® Software Technologies Ltd., the number of mobile devices connected to corporate networks doubled in 2010-2011. Half of these devices contain confidential information.

The management of 70% of the surveyed companies are confident that it is the use of mobile devices that results in the increased number of data leaks. This mostly happens when devices containing corporate emails (80% of cases), client databases (around 50%) and corporate passwords (around 40%) get lost or stolen.

Corporate users are actively embracing mobile devices and services, thus creating a lot of problems for IT experts responsible for the security of corporate data. Modern standards do not cover new security threads, and yet it’s not reasonable to completely stop using mobile devices, since they give users a number of advantages that boost their performance and provide them with quick and convenient mobile access to corporate resources.

Check Point report highlights:

• In 94% of companies, the number of mobile devices connected to corporate networks has increased.
• In 78% of companies, their number has more than doubled over the past two years.
• The most popular mobile platforms used in corporate networks are:

1. Apple (30%)
2. BlackBerry (29%)
3. Android (21%)

• 43% of companies believe that Android-based devices pose a serious threat to their information security.
• The key threats undermining information security are:

1. Lack of knowledge in the information security field among corporate users (over 70%).
2. Use of mobile devices for web browsing (61%)
3. Use of unprotected wireless connections (59%)
4. Device loss of theft (58%)
5. Downloading of malicious software to mobile devices (57%).

Not long ago, an Apple notebook owner (Josh Kaufman) had an unfortunate experience. His MacBook was stolen and the police were not interested in investigating. Usually, that would be the end of the story, but in this case something else happened.

Shortly before the robbery, the owner installed a program on his MacBook which secretly tracked the user. It took screen shots, photos from the inbuilt camera and even identified the probable location of the device by using the Wi-Fi network. The software regularly sent all this data to the owner’s email.

The owner of the stolen computer wrote a blog called “This Guy Has My MacBook” and began to publish the screenshots and photographs in the hope of identifying the thief or of getting the police more interested. Fortunately, the thief didn’t wipe the disk or sell the laptop, but kept and used it himself. As a result Kaufman quickly collected a lot of photographs of the thief sleeping, sitting at the computer, driving his car, etc.

A few days later the police arrested the criminal and returned the stolen property to its owner. According to the police, they were able to make the arrest thanks to the photographs provided by Kaufman.

This story has caused a lot of discussion among MacBook owners. Many of them have asked Apple to add an app similar to the already existing services Find My iPhone and Find My iPad for iOS to the next MacOS version.

Pete Warden and Alasdair Allan, British IT experts, have found out that Apple phones and tablets equipped with a 3G module save users’ location details to a hidden file.

This information (similar to GPS logs in GPX or KML formats) is stored in a file called consolidated.db in an open form and is copied to the PC during synchronization or backup.

This function was found in all iOS versions starting from version 4. This way, anyone with access to another user’s PC or phone will also have access to a large database of fairly accurate data about the device owner’s physical locations since June 2010 (when iOS 4 was released).

Warden and Allan created a compact parser for Mac computers that allows users to project the coordinates collected by the device onto a map.

Relative inaccuracy or the logged coordinates proves that they are not collected using a built-in GPS receiver, but are calculated using the coordinates of base stations in GSM networks. Apple has not provided any comments on this situation.

The encryption algorithm used in Apple AirPlay was successfully hacked by American security experts. The AirPlay technology is used for broadcasting multimedia content to Apple’s mobile devices.

To date, the encryption key of this algorithm has been used for peaceful purposes only: it was used to enable broadcasting to non-Apple devices, including those based on Windows. The experts used an Apple AirPort Express Wi-Fi station to hack the algorithm.

Thanks to this hack already dubbed ShairPort, users can now stream music from their iTunes libraries to other Wi-Fi enabled computers and devices.

Paul Devine, who was Apple’s global supply manager, has pleaded guilty to fraud. As an Apple employee he had access to confidential information which he passed on to third parties.

In this way enterprising companies from Singapore obtained sales forecasts and technical features of future Apple products. They were therefore in a better position to win contracts, and deprive Apple of income. Devine received a percentage from these deals. They were not interested in technical production secrets and new designs.

Paul Devine worked for Apple from 2005. He organised contracts with iPhone and iPad suppliers. His annual salary was about $100 thousand.

He communicated with his clients via email using free email systems (Gmail, Hotmail) from his office, which is where law enforcement officers discovered copies of the emails.

It is a serious mistake to use emails to send confidential information. Statistics show that only 6% of leaks use this method. However, it is becoming much quicker and easier to collect evidence on information leaks through emails.

The ex-manager faces a serious jail sentence. Devine has not been sentenced yet and he is currently free on bail. He has already agreed to pay restitution of almost $2.3 million.

It took only 6 minutes for a team of scientists from the Fraunhofer Institute for Secure Information Technology to pull most of the accounts-related data, including passwords, from a password-protected iPhone.

This attack is based on the already known iPhone hacking methods and requires a physical connection to the device, aiming at its password management system called Keychain.

First of all, the phone is “jailbroken” using publicly available tools. After that, the hacker installs an SSH server on the device and uploads a script that, once executed, pulls all the details of the accounts found in the Keychain system records.

The researchers say that this vulnerability still exists because the cryptographic key in the current iOS versions is not bound to the device blocking code.

The Keychain system can store email account passwords, access details for MS Exchange services, VPN and Wi-Fi access point data and passwords for some user’s applications.

Microsoft is not the only company to show interest in monitoring technologies: a new patent in this area has been recently registered by Apple. It describes a parental control technology intended for mobile devices.

Drafting and approval of this patent by the US Patent and Trademark Office went on for two years — specifically, from 2008, when the original patent application was submitted.

The described technology is essentially an application capable of blocking outbound and inbound messages (SMS and email) containing obscene words (mostly of the sexual nature). Depending on the settings, these messages can be modified, deleted, saved for review by parents or forwarded directly to them.

Unwanted content is detected with the help of a database of dictionaries that also take into account the actual age of the child and the level of his/her personal development. Word abbreviations and intentional word distortions will also be detected and intercepted.

It is still unclear if such an application will ever be included into one of the future firmware updates of iPhone, but this is quite a possibility.