Everything We Know About The Huge Security Flaw That Affects (Nearly) All iPhones, iPads, And Apple Computers
A software bug called "Gotofail" currently affects every single
Apple device, whether it's an iPhone, iPad, or desktop or laptop
computer. If you have not updated your machine in the last few days,
your Apple device is currently vulnerable.
A security firm called Crowdstrike explains how Gotofail works: It "enables an adversary to masquerade as coming from a trusted remote endpoint, such as your favorite webmail provider and perform full interception of encrypted traffic between you and the destination server," and it "give[s] them a capability to modify the data in flight (such as deliver exploits to take control of your system)."
More plainly, this bug tricks your computer into thinking that it's communicating with safe, highly trusted servers on the Internet even if those servers are being used by hackers to monitor and alter the data you send and receive online, even if it's encrypted. Here's what cryptographer and Johns Hopkins University professor Matthew Green had to say:
Apple is generally the company that can be looked at to take care of stuff like this for us, but the way that Apple computers run right now leaves them less than totally safe.
OS X users who want to protect themselves until Apple issues an official fix: the very least you can do is stop using Safari if you weren't already using something else. Try Firefox or Chrome for your web browsing needs and you'll be able to continue making those Amazon purchases without worry.
Apple revealed that the security flaw in its iOS operating system for iPhone and iPad
affects encryption. That's how data gets sent over the Internet without
you having to worry about people reading your emails or stealing your
credit card number when you buy something from Amazon.
The name "Gotofail" is a reference to the "goto" computer command.
A fix recently went out to iOS customers that renders this bug a non-issue, so if you haven't updated your iPhone or iPad's software recently, be sure to do so. There's a full guide right here,
but you'll want to plug your phone in as if you're charging it, open
the Settings app, select "General," then "Software Update," and follow
the instructions that appear.
OS X users are still waiting for a fix. Official word from Apple is that it will come "very soon."
Gotofail directly affects OS X
apps. Any hacker monitoring them would find a goldmine of data if they
wanted it. Major communication apps like Apple's email client and
iMessage are vulnerable, even the Safari web browser. Privacy researcher Ashkan Soltani shares the full list in this screenshot.A security firm called Crowdstrike explains how Gotofail works: It "enables an adversary to masquerade as coming from a trusted remote endpoint, such as your favorite webmail provider and perform full interception of encrypted traffic between you and the destination server," and it "give[s] them a capability to modify the data in flight (such as deliver exploits to take control of your system)."
More plainly, this bug tricks your computer into thinking that it's communicating with safe, highly trusted servers on the Internet even if those servers are being used by hackers to monitor and alter the data you send and receive online, even if it's encrypted. Here's what cryptographer and Johns Hopkins University professor Matthew Green had to say:
Apple is generally the company that can be looked at to take care of stuff like this for us, but the way that Apple computers run right now leaves them less than totally safe.
OS X users who want to protect themselves until Apple issues an official fix: the very least you can do is stop using Safari if you weren't already using something else. Try Firefox or Chrome for your web browsing needs and you'll be able to continue making those Amazon purchases without worry.
No comments:
Post a Comment