Address Bar Security Issue Found in iOS 5.1 Safari
A security firm has discovered a security issue in the iOS 5.1 version of MobileSafari, the most recent version of the operating system that runs on millions of Apple mobile devices. The behavior was discovered and detailed by David Vieira-Kurz of MajorSecurity.net.
The weakness is caused due to an error within the handling of URLs when using javascript's window.open() method. This can be exploited to potentially trick users into supplying sensitive information to a malicious web site, because information displayed in the address bar can be constructed in a certain way, which may lead users to believe that they're visiting another web site than the displayed web site.
To test it out, visit this demo page on an iPhone, iPod Touch or iPad running iOS 5.1. Click the 'Demo' button and MobileSafari will open a new window displaying "www.apple.com" in the address bar, though it's actually loading a page from MajorSecurity.net.
The security firm does note that Apple was informed of the vulnerability three weeks ago, and it is only being made public today. Apple acknowledged the bug and should be pushing a fix soon.
Popular Stories
When the iPhone Duo launched, we shared a list of some of the fun apps developers created for the new form factor. Two weeks out, developers are continuing to come up with fresh ideas, so we thought we'd share some of our favorites.
Games
Marbles Unhinged ($2.99) - Marbles Unhinged is a marble maze designed for the Duo. When you fold it, the floor turns into a ramp. If you stand the top...
Apple is launching five new products on Friday, November 6, following pre-orders that opened last week, including its first touchscreen MacBook Pro models.
The following new products will be available from today:
iPad mini with OLED display and A20 Pro chip
iMac with M6 chip
14-inch MacBook Pro with M6 chip
14-inch MacBook Pro with OLED touchscreen
16-inch MacBook Pro with OLED...
Apple plans to merge the iPhone's Action button with the Camera Control starting next year, according to the leaker known as "Instant Digital."
In a new post on Weibo, the leaker claimed that a single press of the combined button would open the camera, while a long press would trigger the function assigned to the Action button. They explicitly clarified that the dedicated Action button would ...
