GigaOM » Thinstall

Shields Up! Twelve Security Holes Fixed by New iPhone/iPod touch Firmware

Bob Rudis — Tue, 25 Nov 2008 00:00:30 +0000

Weldon did a phenomenal job covering the visible and functional changes in the iPhone/iPod touch 2.2 firmware release. If you are holding off on the update, or just haven’t gotten to it yet, you may want to pencil in some time with iTunes as there are a twelve security fixes in this firmware release, each of which leaves your device and/or data vulnerable to attack.

CVE-2008-4228 & CVE-2008-4229 & CVE-2008-4230 – Passcode Lock – iPhone provides the ability to make an emergency call when locked. Currently, an emergency call may be placed to any number. A person with physical access to an iPhone may take advantage of this feature to place arbitrary calls which are charged to the iPhone owner. This update addresses the issue by restricting emergency calls to a limited set of phone numbers. Also, a person with physical access to the device had the ability (under certain circumstances) to launch applications without the passcode and if an SMS message arrived while the emergency call screen was visible, the entire SMS message would have been displayed, even if the “Show SMS Preview” preference was set to “OFF”.
CVE-2008-2327 & CVE-2008-1586 – ImageIO – Viewing a TIFF image that was crafted to take advantage of poorly coded compression libraries could lead to attackers running any code they choose (i.e. arbitrary code execution) on your system or cause system instability/force a reset (Denial of Serivce/DoS)
CVE-2008-2321 – CoreGraphics – Very similar to the ImageIO problem, this involves attackers using a specially crafted web site to achieve the same results
CVE-2008-4227 – Networking – Your PPTP VPN connections may not be as strongly encrypted as they should be
CVE-2008-4211 – Office Viewer – If you view Excel files on your device, you are susceptible to arbitrary code execution or DoS attacks
CVE-2008-4231 & CVE-2008-4232 & CVE-2008-4233 – Safari – Nasty HTML TABLES (and, when are HTML TABLES not nasty?) and insidious IFRAMEs lead the list of Safari problems, but a particularly tricky bug regarding phone calls you did not deliberately make is now fixed by Apple properly dismissing Safari’s call approval dialogs when an application is being launched via Safari.
CVE-2008-3644 – WebKit – Even if you were a good web programmer and disabled autocomplete on “sensitive” form fields, Mobile Safari may still have saved that field data in the browser page cache. Individuals with physical access to the device could pretty easily gain access to that information.

Organizations that allow iPhones to be used for business purposes should do their best to ensure all users are upgraded as soon as possible. Individuals should take note of the reduced security posture prior to the 2.2 firmware and make their own risk-based decisions (but upgrading gets you the cool new Street View, so go ahead and upgrade now!).

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

Pano Logic Takes $12M

Stacey Higginbotham — Tue, 29 Jan 2008 17:41:04 +0000

The money spigot for virtualization is still flowing, with Goldman Sachs & Co. leading a $12-million round of funding for Menlo Park, Calif.-based Pano Logic. The startup virtualizes the desktop to the point where none of the client computers needs an operating system. IT managers find that sexy, but Pano will have to differentiate itself from blade computing and other client-server “solutions” such as application streaming. When VMware purchased Thinstall earlier this month it gave the entire desktop virtualization category some cachet.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

VMware Acquires Thinstall to Take Virtualization to the Desktop

Stacey Higginbotham — Tue, 15 Jan 2008 17:28:27 +0000

Unless you’re an information technology manager or a Wall Street banker still drooling over VWware’s $32 billion market cap, virtualization is not sexy. But it soon might be, with VMware’s agreement to buy desktop virtualization startup Thinstall. Bringing virtual software to the desktop for employees and consumers effectively makes the portable desktop a reality.

Yes, I know web applications and software as a service can make applications portable, but I’m talking about replicating your enterprise applications on a thumb drive, plugging that into a home or remote computer, working on something, saving it, and then bringing it back to the office. Thinstall enables that entire process; it also offers as a version of what the tech world used to call thin-client computing. Virtualization has more cachet, though.

For VMware, this deal pushes them deeper into the software side of virtualization, which is good considering the company’s dominant market share on the sever side. To feed that huge market cap, VMware needs to grow, so buying Thinstall is a logical step. The move also follows on the heels of VMware’s purchase of small independent software integrator Propero. The company will likely make additional buys to stay ahead of its competition.

As for the competition, it’s not standing still. Last summer Citrix bought server virtualization company XenSource for $500 million; Microsoft purchased desktop virtualization provider Softricity the year before. Today’s move by VMware may put Thinstall competitors such as Endeavors Technologies Kidaro, and InstallFree in play.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.