Security pros say the Apple iPhone OS 3.1's anti-phishing feature falls short, failing to block sites blocked by the desktop version of the Safari browser.
The anti-phishing feature for the iPhone OS 3.1 isn't all it's cracked
up to be, according to security researchers.
For whatever reason, some researchers have found, phishing sites blocked by
the desktop version of Apple Safari are not consistently blocked by
the mobile version. Since Apple
released the iPhone OS 3.1 upgrade on
Sept. 8, testers have found that the performance of the anti-phishing
feature has been spotty.
Mac Security Blog
has reported seeing inconsistencies among iPhones, with
some blocking and others not," said Michael Sutton, vice president of
research at Zscaler. "Based on this information, it would appear that the
problems lie with update mechanisms reporting phishing sites to the phone, as
opposed to the blocking functionality itself."
the Zscaler blog,
Sutton cited two phishing sites (click at your own risk)
as examples of the situation. One is blocked by Safari for OS X but is still
accessible on the iPhone; the other wasn't being blocked by the mobile
edition of Safari at first, but has been blocked since Sept. 10.
Researchers aren't sure what is causing the inconsistent results. Apple has
not responded to inquiries on the matter. But at Mac security vendor Intego,
officials said they will continue to investigate the situation.
"We've tried isolating locations, iPhone [and] iPod touch models, and
whether they are connecting over a cell network or via Wi-Fi, but all we've
come up with is that sometimes it works and sometimes it doesn't," blogged
spokesperson for Intego. "This is clearly more dangerous
than no protection at all, because if users think they are protected, they are
less careful about which links they click."
Despite its inconsistency, Sutton described Apple's attempt
at fighting phishing sites on the iPhone as an important step for mobile
"Mobile browsers have many of the same capabilities as their desktop
counterparts," he said. "Most notably, smartphones now generally have
Despite this fact, security is essentially absent in mobile browsers
altogether. Functionality now standard in desktop browsers such as phishing and
malicious URL blacklists haven't been incorporated into mobile devices. While I
applaud Apple for taking a first step in this direction, it would appear that
they have some wrinkles to iron out."