OS X and iOS Flaw May Allow Your Passwords to be Stolen

If you are an iOS or OS X user and think you are one up in the Smartphone battle after the most recent security flaw in the keyboard on the Samsung Galaxy smartphone, you are not. The Register in the UK is reporting that researchers found a flaw that may allow a hacker to upload malware and steal passwords on those devices.

Apple OS X and iOS users are advised to use extra caution when downloading apps from anywhere, including the official app stores. Do research to make sure the app is legitimate and from a known developer. It is always advised never to download apps from locations other than these places (sideloading), as it increases the risk of executing malware on your device. Also, users should avoid using open public WiFi locations, particularly when doing financial transactions. This is not exclusive to iOS or OS X users, but is recommended for everyone. Hackers often sit in public locations and conduct man-in-the middle attacks attempting to steal sensitive information.

When it is fixed, it should be applied right away. This is recommended when any security or critical patch is released.This newly announced flaw is considered a zero-day vulnerability, meaning it was previously unknown and may be used by criminals before Apple even has a chance to address it. Now that it has been disclosed, it’s reasonable to assume that indeed it is being exploited. The flaw may allow the theft of both Apple's password management, or Keychain passwords, such as those for iCloud and eamil, and app passwords.

Researchers at Indiana University, Peking University, and the Georgia Institute of Technology published a paper on the specifics of this flaw that could allow malicious apps to get access to data stored by other apps. According to The Register, this was reported to Apple four months ago. The company asked for six months leeway it before reporting it. Obviously, this did not happen. According to the team, more than 88% of apps were vulnerable to this.