Heartbleed and iOS

Apple now claims iOS was not affected:

http://recode.net/2014/04/10/apple-says-ios-osx-and-key-web-services-not-affecte d-by-heartbleed-security-flaw/

Not sure what it means that the OpenSSL version makes it appear that it was. However, my question is, are there any apps on iOS that use the OpenSSL software to establish a service that would be vulnerable? This is a server problem, not a client problem, so how and when is iOS used as a server?

Also, if there are instances of iOS using OpenSSL in server mode, does it use heartbeat?

Have your devices ever been jailbroke?

Philly_Phan: I'm not sure what the relevance is of your question. Obviously, if you jailbreak your device, you could set it up as a server and could make yourself vulnerable (if you use and configure a vulnerable version of OpenSSL). Non-authorized apps you run might do this for you (whether you know it or not). However, my own question is about legitimate apps on non-jailbroken devices.

I believe Philly_Phan was asking the OP and not you directly.

I tend to believe that Apple is being honest in their assessment and that the only method to find the detail level and possible bad information that the OP claims would likely come from jail breaking a device.

From: http://www.intego.com/mac-security-blog/heartbleed-openssl-bug-faq-for-mac-iphon e-and-ipad-users/

Can Apple roll out the patch for the bug?

Unfortunately this isn’t a bug in Apple’s software or hardware. The bug exists in open source software that some web servers and networked appliances use to establish secure SSL connections. In other words, there is no patch for your computer or smartphone or tablet computer, as the problem exists on the websites themselves.

http://recode.net/2014/04/10/apple-says-ios-osx-and-key-web-services-not-affecte d-by-heartbleed-security-flaw/

The sky is not falling chicken little.

There is no ios server, since iOS is only an os for mobile devices not hosting systems.

PacBlue wrote:

Philly_Phan: I'm not sure what the relevance is of your question.

robdrage wrote:

There is no ios server, since iOS is only an os for mobile devices not hosting systems.

This is not entirely true. I have an app called "TinyScan" (available on the AppStore) which lets me "scan" documents with my iPhone camera. In order to transfer the resulting scanned documents to a computer, it has the option to set up a "Wi-Fi Drive" which is really just a web server (on the iPhone) with the documents. You can then access it using a standard web browser from any computer on the same WiFi network. Thus the iPhone is acting as host. In this particular case, the server is not using https (it's using http) and thus is not affected by the bug. (Also it uses an internal IP address on your WiFi network, so it is not exposed to the full Internet.) However, if this app maker can add such a feature and use it to transfer files, then other apps and services can do the same thing on your iOS device.

Pythonista does not require a jail broken device. Neither does setting up the iPhone as a server (see my other reply re: TinyScan).

Thank you, I stand corrected on that understanding.

cclauss wrote:

My reading of that description is that BOTH the client and the server are vulnerable if EITHER of them has a vulnerable OpenSSL library. Am I misreading http://heartbleed.com?

You appear to be correct. See the following two posts. However, it is much more difficult to exploit on the client side, as you would have to connect to a malicious server (or impersonated server... which theoretically is possible if an attacker has leaked the security certificates from a site you normally trust). The servers are exposed to the public and anyone can connect and send heartbeat requests to leak information from them. They also contain information on many different people, not just one (at a time). That's why there is so much emphasis on the servers.

http://security.stackexchange.com/questions/55249/what-clients-are-proven-to-be- vulnerable-to-heartbleed

http://security.stackexchange.com/questions/55119/does-the-heartbleed-vulnerabil ity-affect-clients-as-severely