Posts Tagged ‘iPod’


Security researcher Phil discover a Cross-Site Scripting vulnerability exists in the “Chat Message” window in Skype 3.0.1 and earlier versions for iPhone and iPod Touch devices.

Skype uses a locally stored HTML file to display chat messages from other Skype users, but it fails to properly encode the incoming users “Full Name”, allowing an attacker to craft malicious JavaScript code that runs when the victim views the message.

XSS in Skype

To demonstrate the vulnerability, He captured a photo of a simple javascript alert() running within Skype.

Executing arbitrary Javascript code is one thing, but he found that Skype also improperly defines the URI scheme used by the built-in webkit browser for Skype. Usually you will see the scheme set to something like, “about:blank” or “skype-randomtoken”, but in this case it is actually set to “file://”. This gives an attacker access to the users file system, and an attacker can access any file that the application itself would be able to access.

File system access is partially mitigated by the iOS Application sandbox that Apple has implemented, preventing an attacker from accessing certain sensitive files. However, every iOS application has access to the users AddressBook, and Skype is no exception.

He also created a proof of concept injection and attack that shows that a users AddressBook can indeed be stolen from an iPhone or iPod touch with this vulnerability.

To further demonstrate the issue, he had recorded a video of this scenario.

Please see the video & use the comments section on his blog for your questions.

Skype Attack Message

Skype Attack Loading

Update
In case anyone is wondering, Phill disclosed the vulnerability to Skype on 8/24 & been told an update would be released early this August but no update yet.


Apple has released iTunes 10.1.2 and it is available via Apple’s iTunes download page and the Mac’s and PC’s software update application. The update is required for iTunes to function with the Verizon iPhone 4. Apple specifically says the “CDMA iPhone 4,” so this may be a hint at a CDMA iPhone 4 hitting carriers other than Verizon Wireless in the United States. The update also brings many important stability and performance enhancements.

CoreBuilder

MA

 

iTunes 10.1.2 syncs music, movies, and more with iPhone 4 (CDMA model) and provides a number of important stability and performance improvements.

iTunes 10.1 came with several new features and improvements, including:

• Use AirPlay to instantly and wirelessly stream videos from iTunes to the all-new Apple TV.

• Sync with your iPhone, iPad, or iPod touch with iOS 4.2.

itunes10.1.2

 

Apple may also release a new iOS4 version soon! iOS4.3? May be Smile

Jailbreaker Please stay away from the new upgrade

Capture


IMG_0901

Using its Skydrive Cloud servers, Microsoft is now allowing iPhone users to sync and use their desktop OneNote application data on iPhone.  Microsoft has long been talking about bringing their Office functionality to the iPhone and this is the first indication of doing that (OneNote is part of the Office suite).

Microsoft OneNote Mobile is the easy-to-use, powerful note-taking application for all of your ideas, brought to you by Microsoft Office. OneNote Mobile lets you create and view notes and lists whenever you need them. Sync your notes with free Windows Live online storage and access them from virtually anywhere using your phone, PC, or almost any web browser.

 

 

 

IMG_0902

With OneNote Mobile, you can:
▪ Create flexible notes that can include text, pictures, bullets, and checkboxes
▪ Check To Do items off on the go
▪ Save time with quick access to your most recent notes
▪ Work with confidence—OneNote Mobile automatically syncs your notes with Windows Live in the background
▪ Organize your notes into sections or create new notebooks using OneNote 2010 or OneNote Web App and access them from your iPhone
oneNote-iphone_page_ui

Requirements:
▪ iPhone or iPod touch must have iOS 4.2 or higher
▪ A free Windows Live ID is required to use OneNote Mobile —use an existing one or let OneNote Mobile help you sign up
▪ Web functionality uses the free OneNote Web App available on Windows Live, which requires a supported web browser
▪ OneNote Mobile opens notebooks created in Microsoft OneNote 2010 or the OneNote Web App
▪ Customizing section colors requires Microsoft OneNote 2010

Good News is it is free for limited time only Download in iTunes

Learn from microsoft