Apple and Samsung warnings

Security researchers are sounding warnings about separate flaws that put millions of Android, iOS and Apple OS X devices at risk.

A keyboard-related flaw affects more than 600 million Samsung devices, and could be used to remotely run malicious code. Separately, researchers say they have identified a series of vulnerabilities - dubbed `Xara` - in Apple iOS and OS X devices that allow them to sidestep the OS X sandbox. The flaws could be exploited by malware to steal data and passwords, for example, by cracking the built-in Keychain password manager in OS X.

The Xara flaws - for `cross-app remote access` - were discovered by researchers from Indiana University, Georgia Institute of Technology, as well as Peking University and Tsinghua University in Beijing.

The flaws stem from both iOS and OS X failing to authenticate many types of app-to-app and app-to-OS interactions, the researchers write in a related research paper. `We found that the inter-app interaction services, including the keychain and WebSocket on OS X and URL Scheme on OS X and iOS, can all be exploited by custom-developed malware to steal such confidential information as the passwords for iCloud, email and banks, and the secret token of Evernote.`

The researchers have posted online demonstrations of how Xara could be exploited to steal iCloud tokens, passwords from the Google Chrome browser and private notes from Evernote users. They also demonstrated an attack using the WebSocket protocol - used to display Web content in apps - that allowed them to intercept all passwords from 1Password that get used in the Chrome browser. And while they have not given Xara its own logo - as so many firms now seem to do - other researchers quickly obliged.

Apple did not immediately respond to a request for comment about the Xara flaws. But the researchers say that hundreds of apps that they studied have these flaws, although they could be corrected if developers rewrite their apps (see Securing Homegrown Mobile Apps). Still, it`s unlikely such moves would happen quickly. `Since the issues may not be easily fixed, we built a simple program that detects exploit attempts on OS X, helping protect vulnerable apps.` The researchers have promised to release that program soon.

Read original article