Is your iPhone giving out your info?

The use of mobile devices is on the rise in Singapore, both amongst end users as well as enterprises. In a recent Google study, Singapore has the highest smartphone penetration rate in the world at 62 per cent– ahead of the US, UK and Japan.

Known for being early adopters, Singaporeans consistently show an appetite for the latest advances in smart-mobile technology, with Apple’s iOS leading the pack at about 75 per cent share across mobile-device users in Singapore.

Naturally, with this growing usage of the iOS comes a proportionate hunger for iOS applications (apps). As of March 2012, over 25 billion apps had been downloaded from Apples’ App Store worldwide, with Gartner forecasting this number to reach more than 70 billion by 2014.  In Singapore, 72 per cent of iOS mobile-device users download and use iOS apps on a daily basis.

However, the popularity of the iOS has been accompanied by security breaches originating from the apps; breaches involving privacy issues related to personal data, as well as financial data. These are exacerbated by today’s mobile workforce that consolidates sensitive professional and personal information onto these smart devices.

In recent years, most security breach news stories focused on Windows products being infected by viruses; leaving many Mac users to believe they were insulated from these breaches.

Conversely, during Black Hat, the information-security conference held in the US in July, security professionals and developers acknowledged some current and real vulnerabilities in Apple’s products and its iOS monoculture. For the first time, Apple participated in this event and discussed new security technologies built into iOS.

A survey revealed that developers of iOS apps inadvertently introduce vulnerabilities into their apps simply because they place more priority on the functionality and usability aspects of an app, at the expense of security requirements.

Therefore, when developing an app, they put unsuspecting end-users’ security at risk. We examined the “Top 50 Free iPad” apps in Apple’s App Store to see how well they stood up to security scrutiny and uncovered some worrying facts:

1. Apple had discouraged app developers from incorporating Apple’s unique device identifier (UDID), as it allows the user to be tracked, profiled and targeted by ad networks, without the user’s permission. Yet, this research revealed that UDIDs are utilised by 44 per cent of the apps, with game-type apps being the worst offenders.

2. Eighty per cent of the top apps fail to use transport-layer encryption properly, which means that in a wireless hotspot, the data being sent over the wireless network is accessible to anyone on that network.

3. Twenty per cent of the apps analysed cached information like usernames, chat logs, copies of previously opened files, and search-history logs in the application’s directory. One app was even found to be sending crash dumps containing the user’s device information to an Internet server without permission.

The good news for iOS users is that Apple has now released its first guide to iOS security – an unprecedented move for Apple. It details the security technology and features implemented within the iOS, including hardware-encryption as well as technology to further protect data stored in flash memory.

In addition, Apple shows its focus on mobile security by acquiring AuthenTec, a leading provider of mobile and network security, to offer biometrics and identity management for all its devices.