The dark side of the iPad: 8 security flaws

Just a few days out the gate and the new Apple iPad has already become the victim of a jailbreaking hack. The iPhone Dev team -- the notorious iPhone OS hacking group -- demonstrated a jailbreaking hack to the long-awaited iPad, after its release in Apple retail stores across the US Saturday.

This was not particularly surprising, considering that the iPad's nearest cousin, the iPhone, has been subject to a slew of jailbreak attacks since its inception. But the attack likely foreshadows a barrage of jailbreaking assaults yet to come as some adventurous iPad hobbyists and hackers attempt to open up their device to a new world of applications and software not found or approved by the Apple App Store.

Experts contend that the iPad's allure as a worthy attack vector could be directly proportional to its popularity -- and ultimately it's adoption in the workplace. As iPad adoption edges into the marketplace of competitive notebooks and e-readers, hackers will see it as a credible means of ensuring a malware distribution that guarantees a high rate of return, experts say. "What's going to drive the level of threat is the level of adoption," said David Perry, global education director for security company Trend Micro.

Essentially, any malware exploiting a browser-based vulnerability on the iPhone or iPod Touch will work equally as well on the iPad, given that all three devices share a practically identical OS. And as with the iPhone, one of the most vulnerable attack vectors in the new iPad will be browser based, which will likely subject the device to numerous web kit vulnerabilities.

Daniel Hoffman, executive vice president and chief technology officer for SMobile Systems, said that he had seen malicious apps make their way into Apple's App store. Meanwhile, Apple prohibits any third party software, including security software, from being installed on its mobile devices, which doesn't bode well for the iPad, considering its anticipated mass consumer appeal, security experts say. "You wouldn't think of doing mobile banking without having antivirus on your system," Hoffman said. "With these new devices, you do not only see that's not offered, Apple is prohibiting third party vendors from developing applications. It's that they're being prohibited from being installed."

The iPad's email client is another formidable threat vector. While thus far there haven't been many email vulnerabilities in OS X, Apple researcher Kevin Finisterre said that he detected a buffer overflow vulnerability in the OS X Mail.app email client, which would enable hackers to infect users by sending malicious attachments over email, among other things. A similar hack could easily be executed on the iPad, he said. "You're talking very minimal interaction on the user's part. You typically don't find it odd to get an e-mail with an attachment on it," Finisterre said. "A vulnerability like that obviously would be a direct and easy way to impact the user of that device."

The launch of the iPad has also raised concerns in the security community due to the fact that it lacks comprehensive encryption and password protection functions, despite the fact that the new device touts mobile e-mail and Web capabilities. The lack of beefy encryption doesn't bode well for a device that consumers will be using as one of their primary communications tools, experts said.

Hoffman, of SMobile Systems, said that from a forensics standpoint, iPad's embedded encryption was "worthless." '"(Encryption is) implemented in such a poor manner," he said. "It was as if it didn't have any encryption.'

Hoffman added that the iPad does not include a built-in firewall, which will inevitably pave the way for hackers to access users' devices, and make them especially vulnerable when users are accessing the Web from public networks.

"A lot of these devices connect to different carrier networks. A common connection point is Wi-Fi, which certainly is great from a productivity standpoint. From a security standpoint, it's a nightmare," Hoffman said. "The number one security measure is a firewall. Today, there're not any of these devices that are going to have be firewall enabled."