Apple iOS bug puts iPhones and iPads at risk

Security researchers have discovered a new flaw in Apple's iOS that could expose every action the user takes to a third party, even down to each letter and number typed. A team from security company FireEye have outlined how they were able to get an app onto iOS 7 devices such as iPads and iPhones that would monitor every single tap of the screen and broadcast that information to any remote server. Such information would potentially give hackers access to every single SMS, email and written note as the location of the screen presses gives away which button is being pressed on the virtual keyboard. The app can also record every home button press, changes of volume and TouchID fingerprint scanner use. Researchers claim that the attack is only at the "proof-of-concept" stage and there is no evidence that it has been used outside of a lab. And the group have informed Apple of their work and claim to be "collaborating on the issue". The attack works on even the latest version 7.0.4 of iOS and on non-jailbroken iPhones. <more>

Wi-Fi 'virus' could be used to attack wireless access points

Researchers from the University of Liverpool have demonstrated that a computer virus can spread through Wi-Fi access points between homes and businesses just like the common cold spreads from one human to another. The researchers have performed an experiment in a laboratory setting with the aid of the Chameleon virus, which uses a WLAN attack technique to infect access points and collect the credentials of all Wi-Fi users who connect to it. Then, it seeks out other access points, connects to them and infects them. The main issue highlighted by the researchers is the fact that many Wi-Fi access points are unprotected, allowing viruses like Chameleon to spread without difficulty. In their experiment, researchers simulated an attack on the cities of Belfast and London. While the virus can't spread via access points protected by encryption and passwords, it relies on ones that are not protected, like the ones in airports and coffee shops. <more>

Microsoft delivers 'Fix it' solution for IE10 attacks

Microsoft has finally issued a security advisory addressing the IE zero-day that has been recently actively exploited in attacks in the wild, and has followed with a Fix it tool to temporarily mitigate the issue until a patch is released. This zero-day is a remote code execution vulnerability, which may corrupt memory and allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer. The vulnerability is easily triggered, and requires the targets to simply visit a specially crafted website hosting the exploit, or websites that accept or host user-provided content or advertisements that could exploit the vulnerability. It's only a matter of luring users to such a site. <more>