While Apple’s Mac OS X reputation for superior security to Windows has little technical basis, iOS (the operating system for iPhones and iPads) is a very different story. As such, when nearly a quarter of a million Apple accounts were compromised by malware recently, it was a big surprise for many people.
So far Apple has been able to keep the iPhone and iPad almost completely free of malware. While iOS malware – some of it apparently created by intelligence agencies – does exist, only a minority of users have been vulnerable to most of it.
And to be vulnerable, an iOS device must first be “jailbroken”.
iOS’s “jail” – or to put it more diplomatically: its “walled garden“ – is at the root of its impressive security record. But this comes at a price that some users are not willing to pay, and this places them at greater risk of being hacked.
iOS Security: Signatures Required
Every iOS device contains special hardware and software designed to ensure that only software authorised by Apple can be run on it.
Every piece of software that runs on an iOS device, including iOS itself, must be digitally “signed” by Apple with the private half of a two-part digital “key”. Each iOS device has the “public” half of the key. Before any piece of software is allowed to run, the phone uses the public key to check whether the software signature is authentic and applies to the software actually present on the device. If either the software or the signature have been modified, the software will not run.
This signature is practically impossible to forge without access to Apple’s private key. And, thus far, the mechanisms within iOS for checking signatures have been pretty much watertight, at least without physically connecting the phone to a computer with a USB cable.
Related mechanisms allow Apple to restrict a downloaded app from running on an iOS device or to revoke permission for an app to run at any time. Notably, this means that using illegally copied software is impossible on an unmodified iOS device.
All apps on Apple’s App Store are signed by Apple. These apps are made available on the App Store only after they have undergone an extensive vetting process according to the company’s published guidelines.
While keeping malware and other forms of objectionable software off the App Store is a primary goal, the guidelines also impose commercial restrictions. For example, subscription apps must use Apple’s payment mechanism, on which Apple collects a 30% commission.
This practice has attracted negative comment from US federal Senator Al Franken, who has asked the Federal Trade Commission to investigate what he views as potentially illegal anti-competitive behaviour under US law.
Tinkerers, Pirates and Foreign Language Speakers
Some iOS users are unwilling to accept the restrictions imposed on them by Apple, or sometimes Apple-authorised apps, for a variety of reasons. To circumvent these restrictions, they take advantage of flaws in iOS’s security regime to install additional non-authorised software by first “jailbreaking” their device.
Jailbreaking an iOS device requires a program such as TaiG, which anonymous programmers have made available at no cost. A user downloads TaiG to their PC or Mac, connects their iOS device and then runs TaiG.
As well as allowing the user unfettered access to the files hidden behind the scenes on their iOS device, TaiG installs a “package manager” called Cydia. Through this they can install new apps unapproved by Apple, which are available from a variety of third-party repositories, as well as “tweaks” to modify existing apps.
Some of the extra functionality downloadable through Cydia includes a tweak to allow easy saving of photos on an Instagram feed, modifying the system fonts and improved Chinese language input. Historically, Apple’s stock iOS Chinese keyboard has been inferior to unauthorised third-party keyboards.
