[Update: it appears that the information I had earlier was incorrect or out-of-date, and there has been loss of life. There's also a report from TechHerald suggesting early exploitation of the incident for SEO poisoning leading to fake AV. However, a quick scan currently (Monday evening) shows news items from such known malefactors as the Guardian, Sky, the BBC and CNN.]
Barely two days after the iPad hit the Apple retail shelves, the first stories about iPad jailbreaking have appeared.
I commented over at Mac Virus that:
"...even in the absence of known issues like those I blogged about ad nauseam in another blog, a viable iPad jailbreak does open up similar possibilities for the promotion of malicious apps. I guess we’ll see whether the bad guys see iPad users as a fat enough target once the market (and the exploits) have had time to mature"
Minutes after I posted that, Aryeh flagged a site that is offering to give away 25 iPads a week. Since I can't seem to get past the "free survey" popup, I'm not sure if this is extreme adware, a gimme-your-data scam, or an attempt to distribute malware, but I'm guessing that not many respondents will ever see a free iPad.
This is probably a good time to point out that (irrespective of how imminent iPad-specific threats may or may not be), a sexy new gadget gives lots of opportunities for scams and threatware that use it to pique the interest of potential victims.
And, of course, we all love a gadget in this business. You may have noticed a certain amount of interest in the new series of Dr. Who in the UK, where the newly-regenerated doctor turns out to be a gadget freak more than usually fixated on his sonic screwdriver (how Freudian...) and the Blackberry Storm, which he used to save the Earth (again), this time by uploading a virus. Technology has evidently moved on since Jeff Goldblum used an Apple PowerBook to do the same thing in "Independence Day". (What will we do if we're ever threatened by aliens who don't have ADB ports or Internet access?)
Low tech social engineering is still more of a threat than iGadget jailbreaking, and any news topic (real or invented) can be dragged into service in order to grab a victim's attention.
I was just asked about the likelihood of criminals using the Richter 7.2 earthquake in Mexicali yesterday for SEO poisoning. My first thought is that an earthquake in an uninhabited area that causes no damage, no loss of life, and no tsunami warnings, doesn't seem likely to grab the sort of criminal interest that the Russian bombings did. On the other hand, when I did a couple of quick searches to see what interest there was, while I didn't see anything clearly malicious, I was just looking at "Results 1-10 of about 17,500,000..." It would be naive to assume that none of those 17.5 million results would turn out to be malicious. And no-one ever said that the bad guys had to use real stories, let alone stick to the facts.
David Harley CISSP FBCS CITP
Research Fellow & Director of Malware Intelligence
ESET Threatblog (TinyURL with preview enabled): http://preview.tinyurl.com/esetblog
ESET Threatblog notifications on Twitter:
http://twitter.com/esetresearch; http://twitter.com/ESETblog
ESET White Papers Page: http://www.eset.com/download/whitepapers.php
Securing Our eCity community initiative: http://www.securingourecity.org/
Also blogging at:
http://amtso.wordpress.org/
http://avien.net/blog
http://blogs.securiteam.com
http://blog.isc2.org/
http://macvirus.com/
http://chainmailcheck.wordpress.org
http://smallbluegreenblog.wordpress.com/
