sb-eu logo
Story image

Apple says DON’T fear about leaked source code – experts say DO

10 Feb 2018

Yesterday an anonymous user posted what experts believed at the time to be the source code for a key component of the iPhone’s operating system on GitHub.

Apple indirectly confirmed the code to be real soon after when it demanded GitHub to take the source code down with a DMCA legal notice.

The code on GitHub was labelled ‘iBoot’, which is a key cog of iOS responsible for making sure the operating system ‘boots up’ safely and securely. This means of all the processes running behind iOS, it is the very first to start up when an iPhone is turned on.

The code indicated that it was taken from iOS 9 butt experts say there are portions of it that are still likely to be used in the newest operating system, iOS 11.

While various parts of iOS and MacOS have been made open source in recent years, Apple has gone out of its way to ensure iBoot’s code remains private – in Apple’s bounty program, bugs in the boot process are deemed the most valuable and can fetch up to US$200k.

Apple confirmed in a statement that the source code had been posted online, but asserted it was three years old and that by design the security of their products aren’t based on the secrecy of their source code.

“There are many layers of hardware and software protections built in to our products, and we always encourage customers to update to the newest software releases to benefit from the latest protections,” the statement from Apple read.

So what are the actual implications of this leak? Arxan Technologies VP of product, Rusty Carter says iBoot’s leak  could potentially allow hackers to find security holes in the smartphone, enabling them to analyse Apple’s code, replicating and manipulating it for malicious purpose.

"Apple iOS is widely viewed as the most trusted mobile operating system out there. But the leak of this source code is proof that no environment or OS is infallible, and application protection from within the application itself is crucial, especially for business-critical, data-sensitive applications,” says Carter.

“It's only a matter of time before the release of this source code results in new and very stealthy ways to compromise applications running on iOS."

Various experts online agree with Carter, reporting the leak could pave the way for hackers to find flaws and bugs to enable them to crack or decrypt an iPhone. There is also the potential for advanced programmers to ‘clone’ iOS onto non-Apple platforms.

Story image
Cybersecurity market continues meteoric ascent - damages to reach $6 trillion
With the increase in cyberattacks, organisations are continuing to spend more money on security. However, without a focused cybersecurity strategy, they often spend it in the wrong areas.More
Story image
Radware launches DDoS protection for online gaming
“Online games are a massive, multi-billion-dollar industry, but they frequently fall victim to powerful and targeted DDoS attacks,"More
Story image
CrowdStrike targets Zero Trust blind spot with new offering
CrowdStrike has officially launched CrowdStrike Falcon Zero Trust Assessment (ZTA), designed to aid in overall security posture by delivering continuous real-time assessments across all endpoints in an organisation regardless of the location, network or user. More
Story image
Gartner reveals the top strategic tech trends for 2021
“CIOs are striving to adapt to changing conditions to compose the future business - this requires the organisational plasticity to form and reform dynamically. Gartner’s top strategic technology trends for 2021 enable that plasticity.”More
Story image
BlackBerry partners with ServiceNow for incident response management
BlackBerry has announced it has entered into a partnership with ServiceNow to integrate the BlackBerry AtHoc service within the Now platform for rapid crisis communications and IT service management. More
Story image
Ransomware attacks skyrocketed in past three months - Check Point
The daily global average of ransomware attacks jumped 50% in last quarter, compared to 1st half of 2020.More