BetaNews: Using Mailbox for iOS? There's a JavaScript security hole to beware of

mercredi 25 septembre 2013

Using Mailbox for iOS? There's a JavaScript security hole to beware of

A potentially serious security flaw in iOS email app Mailbox is being investigated. Michael Spagnuolo, an Italian computer engineer writes about discovering that the app automatically executes any JavaScript that might be embedded in the body of an email.

Michael has recorded a video demonstrating a few proofs of concept which leaves iPad and iPhone users open to potential attack. His example scenarios are purposefully harmless -- he has opted to show how opening an email could lead to an app being opened without permission or instigate a tweet or SMS (although it is not sent without confirmation) -- but the security hole is going to make many users feel uneasy.

Michael writes: "This is bad for security and privacy, because it allows advanced spam techniques, tracking of user actions, hijacking the user by just opening an email, and, using an exploiting framework, potentially much worse things".

What’s particularly concerning about this is that it could be exploited in conjunction with a specially coded app to wreak unknown damage. This would obviously mean that a compromised app would have to find its way into the App Store or a third party app would have to be installed on a jailbroken device, but it is still a worrying possibility.