Pwned: How can I prevent my iPhone from being hacked?

Following our last blog entry, we were inundated by personal requests asking us:

• How do iOS devices (iPhone, iPod) become infected with spyphone malware?
• And more pressing, how to prevent a spyphone installation?

How are iOS devices hacked?

In order the install the spyphone software, the attacker first needs to jailbreak the device. Jailbreaking methods are constantly changing. For past iOS versions, it was as easy as clicking a PDF – in which case the attacker did not need physical access to the device. And although this could be done by sending an email with a link, it could even be performed by simply browsing to a site. These past PDF-related vulnerabilities have since been patched but unfortunately, owners who are slow to update their devices are still vulnerable to this type of remote jailbreaking.

Nowadays, the most common method is to physically jailbreak the device – via the USB connection. This process is very quick and an experienced individual can install the wares in under 5 minutes  – right about the time the device’s owner leaves their iPad on the to grab a cup of coffee.

With jailbreaking out of the way, the attacker can then download the spyphone tools. The first thing that the software does? Hides any indication of the phone being jailbroken.

How to prevent spyphone installation?

The surreptitious surveillance software also hides any signs of being planted on the user’s device. So while detection methods for the individual user are still lacking, you should always follow these best practices to prevent iPhone spyphone installation. Although these won’t prevent an attacker dedicated to compromising your device, they do mitigate those random targets –

• Keep your mobile next to you at all times
• Choose a strong device-locking password
• Sync with iTunes as often as possible in order to perform system upgrades