Report: Security firm hacks iPhone

A group of security experts in the United States say they have discovered a flaw in Apple Inc.'s iPhone that can be exploited to allow hackers to take control of the hand-held device.

Baltimore, Md.-based Independent Security Evaluators (ISE) published an explanation of the flaw and its exploitation on a web page on Thursday.A more detailed explanation is to be presented at a conference in early August.

According to ISE security expert Charlie Miller, the exploit is delivered via a malicious web page opened in the Safari web browser on the iPhone. The iPhone user can be tricked into opening the web page either through an attacker controlled wireless access point or a link delivered via e-mail or text message. A modified version of the exploit can also be delivered through a misconfigured forum website.

In order to gain control of the handset through Wi-Fi, or wireless network, the hacker would have to create a network with the same name and encryption method as one the handset already uses. The attacker then substitutes a web page with their own malicious code, Miller wrote.

Once an attacker gains control of the iPhone they could read the iPhone's message log, address book, call history and voice mail information, the ISE report said.

ISE published the exploit as a proof-of-concept and included a number of suggestions for fixing the problem.

Apple's spokesperson Lynn Fox told CBC News: "We're looking into the report from the ISEand always welcome feedback on how to improve our security."

Web-based exploits such as the one detailed are relatively common and require software companies to continuously update their security features to close loopholes in the software.

But because Apple's Safari browser and OS X operating system are used by a small percentage of the personal computing market, the software has traditionally been a less appealing target for hackers.

"The attention the malware community gives a device is directly correlated with the adoption in the marketplace," Symantec director of mobile security Paul Miller told CBC News in May.

"It's not a function of the operating system, it's a case of market penetration," he said.

Security analysts have speculated the iPhone's expected popularity could make the hand-held device and Apple software in general a more appealing target.

Apple is expected to release its third quarter results later this week, with much of the attention to focus on the last two days in June when the mobile device was officially launched.

The device, which combines many of the features of a personal computer with those of a mobile phone and digital media player, was released on June 29 in the United States. No Canadian release date for the iPhone has yet been issued.