iPhone worm portends precarious problem for Apple

Stan Beer
Wednesday, 11 November 2009 12:52

Opinion and Analysis

This year, according to at least one report, Apple has sold about 20 million iPhones. A young post-secondary college student easily figured out a way to hack into them and inject a worm. It doesn't take a genius to figure out that Apple has a big security problem. Is it prepared?

With the iPhone continuing to take the world by storm, there seems little doubt that Apple will sell at least 20 million and probably considerably more of the popular handset in 2010. In addition to all the consumers, iPhones because of their power and versatility will become increasingly used in business and connected to corporate networks.

Historically, the main factor cited by security experts that has protected Macintosh computers from malware attacks is the relatively small installed user base. Yes, it can be argued that Mac OS X is inherently more secure than Windows but there's no doubt that malware purveyors are always going to pick targets with the largest installed base.

Unfortunately for Apple it looks like it could well become a victim of its own success in this regard.

The fact is that, with 10 million or more Macs sold in 2009, security experts are already nervously watching the rapidly expanding Macintosh sales and talking about the installed Mac base as becoming an increasingly "worthwhile" target for criminals.

In his blog, J R Smith, the CEO of security vendor AVG, points to the fact that Macintosh has now around 10% revenue market share in the US.

"From a technology perspective, the Mac is based on a Unix foundation. However, more recent Trojans can override the protection that Unix has historically provided. This, combined with the effort Microsoft has made in the latest OS release, has reduced the “safety” edge that the Mac has enjoyed. In fact, some researchers are saying that the Mac OS is now more vulnerable the Windows OS," Smith says.

If that's true, then whatever the potential security issues for the Mac should be compounded many times in the case of the iPhone.

Since its launch, Apple has proudly proclaimed that the iPhone had a "real" full-strength operating system in OS X.  In fact, the iPhone OS is not the same full strength Mac OS X that powers Mac computers, although it is based on the same kernel.

Thus we have a popular device in the iPhone, that is outselling by at least two to one the already popular Mac computers, which has a small footprint and relatively simple (compared to Mac OS X) operating system.

As has just been demonstrated by a young amateur, the iPhone OS is easy to hack. Combine that with its massively expanding installed user base and Apple (or rather iPhone users) have a real problem that won't simply go away.

The question is how long will it be until security vendors start selling the idea that iPhone AV and Internet security software is mandatory?