Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

And if so, have there been any recorded instances of this?

(I'm excluding the so-called "jail broken" devices.)

share|improve this question

4 Answers 4

up vote 10 down vote accepted

Yes, security vulnerabilities that would allow people to hack or infect Macs and iOS products do exist, though they're not exploited very often.

Pwn2Own is an annual contest where competitors try to hack into machines to win them as prizes. Both Macs and iOS products are hacked most years.

Here is one more story about an exploit that was patched:

Friday, Apple released an update to its mobile operating system (iOS 4.3.4) which patches a couple of vulnerabilities that left a door open for malware infections on the iPad, 3rd and 4th generation iPod touch, iPhone 4, and iPhone 3GS.

Apple's update describes the CoreGraphics vulnerability as "A buffer overflow…in FreeType's handling of TrueType fonts. Viewing a maliciously crafted PDF file may lead to an unexpected application termination or arbitrary code execution."

[...]

This update comes on the heels of an alert from German IT group BSI, which warned of an unpatched vulnerability that would "allow attackers to gain access to the entire system with administrative privileges."

Apple does "verify" any software for their App Stores, but developers have been known to sneak in features without Apple's testers seeing them, so don't expect this to entirely protect you.

share|improve this answer
1  
"Apple does verify any software for their App Stores": The more scary exploits are the ones that come over the web, without the need to install any apps. –  Thilo Jul 22 '11 at 5:35

The fact that the devices can be jail broken at all means that there are exploitable weaknesses in the security of iOS, because jail breaks involve bypassing the usual security to be able to run software that you couldn't otherwise run.

But -- being jail broken doesn't necessarily mean you are more vulnerable.

That said, unless the jail breaker's are lucky and can find a serious flaw like the recent PDF exploit, jail breaking an iOS system can be a little involved. Someone might be able to get you to click on a link on a website, but not go through a multi-step procedure where you are rebooting the devices with buttons held down, etc.

I've not heard of an in-the-wild trojan/virus for iOS.

share|improve this answer
    
If you've heard of jailbreak.me, you've heard of an in-the-wild trojan/virus. –  Jason Salaz Jul 23 '11 at 1:27

I think the answers here are a bit misleading. iOS is widely held to be the most secure software platform, mobile or otherwise. Any human made software system is vulnerable, but so far there has been no malware of any sort reported for iOS. It's an attractive target, though, and the existence of jailbreak exploits means that it's not impossible.

share|improve this answer
    
I agree. The question asks "is it possible.." but the better question is "how likely is it", particularly relative to other operating systems. –  David Jul 22 '11 at 13:03

It is possible, but not likely to get a virus from an app. All iOS apps are vetted by Apple. A virus is generally malicious code installed and run unintentionally. Because all apps are checked, unless you jailbreak jailbreak device, you should be safe.

On the other hand, as has been pointed out in the comments, it is quite possible that an iOS device can get infected via vulnerability in Safari or, as was specifically mentioned, the PDF reader. This is possible largely because the content that comes in from the web is not checked by anyone. The situation is worse on iOS because you cannot install antivirus. (Apple wouldn't allow an app that integrates that deeply with the OS into the store.) Contrast that with "traditional" computing environments where such protections are available.

share|improve this answer
1  
The fact that apps are checked doesn't mean that an iOS device couldn't get malicious code run on it. The recent PDF vulnerabilities could have been exploited to run malicious code on devices. –  andynormancx Jul 21 '11 at 20:32
    
The more scary exploits are the ones that come over the web, without the need to install any apps. –  Thilo Jul 22 '11 at 5:36
    
Indeed I did forget about web based exploits. An excellent point. Edited. –  Moshe Jul 22 '11 at 12:06

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.