Apple iPhone OS 3.1 Phishing Protection Falling Short, Researchers Say

The anti-phishing feature for the iPhone OS 3.1 isn't all it's cracked up to be, according to security researchers.

For whatever reason, some researchers have found, phishing sites blocked by the desktop version of Apple Safari are not consistently blocked by the mobile version. Since Apple released the iPhone OS 3.1 upgrade on Sept. 8, testers have found that the performance of the anti-phishing feature has been spotty.

"The Mac Security Blog has reported seeing inconsistencies among iPhones, with some blocking and others not," said Michael Sutton, vice president of research at Zscaler. "Based on this information, it would appear that the problems lie with update mechanisms reporting phishing sites to the phone, as opposed to the blocking functionality itself." 

On the Zscaler blog, Sutton cited two phishing sites (click at your own risk) as examples of the situation. One is blocked by Safari for OS X but is still accessible on the iPhone; the other wasn't being blocked by the mobile edition of Safari at first, but has been blocked since Sept. 10. 

Researchers aren't sure what is causing the inconsistent results. Apple has not responded to inquiries on the matter. But at Mac security vendor Intego, officials said they will continue to investigate the situation.

"We've tried isolating locations, iPhone [and] iPod touch models, and whether they are connecting over a cell network or via Wi-Fi, but all we've come up with is that sometimes it works and sometimes it doesn't," blogged Peter James, spokesperson for Intego. "This is clearly more dangerous than no protection at all, because if users think they are protected, they are less careful about which links they click."

Despite its inconsistency, Sutton described Apple's attempt at fighting phishing sites on the iPhone as an important step for mobile device security.

"Mobile browsers have many of the same capabilities as their desktop counterparts," he said. "Most notably, smartphones now generally have JavaScript engines and as such are vulnerable to many of the same attacks. Despite this fact, security is essentially absent in mobile browsers altogether. Functionality now standard in desktop browsers such as phishing and malicious URL blacklists haven't been incorporated into mobile devices. While I applaud Apple for taking a first step in this direction, it would appear that they have some wrinkles to iron out."