Apple devices are vulnerable, too

Apple devices are vulnerable to attack, say German security officials.
Statement warns iPhone and iPad users to visit only trustworthy websites and avoid PDFs until Apple releases fix.

Members of the technology media try out Apple's "iPad" after its launch event in San Francisco
Apple is investigating reports of possible vulnerabilities affecting some of its mobile devices. Photograph: Kimberly

Several Apple devices including the iPhone and iPad have two critical security weaknesses for which no patch exists, the German government warned last night.

Users of Apple mobile devices should only use websites they deem trustworthy and refrain from opening PDF files until Apple releases a fix, Germany's federal office for information security said.

"This allows potential attackers access to the complete system, including administrator rights," the statement warned. "It has to be expected that hackers will soon use the weak spots for attacks."

Apple said it is investigating reports of vulnerabilities affecting the iPad, iPod Touch and iPhone.

The potential security flaw concerns the mobile internet browser Safari, and the way it opens PDF files in Apple's iOS software. The vulnerability arose over the weekend when US-based hackers launched JailbreakMe, a browser-based service that can unlock Apple devices from restrictions imposed by the manufacturer.

Early reports suggest this system – last week ruled legal in the US, despite opposition from Apple – exploits the same shortcomings highlighted by the German government. The launch of JailbreakMe brought extensive attention to the vulnerability which security experts warn could be exploited for crime.

The warning relates to iPhones using iOS versions 3.1.2-4.0.1, iPads using iOS 3.2-3.2.1 and the iPod Touch using iOS 3.1.2-4.0, though the German federal office said older versions of the mobile operating system could possibly be affected.

Analysts at research firm Gartner said these fresh security worries point to more fundamental problems with the way Apple operates. Ken Dulaney, a vice president, said: "This security hole will likely be repaired by Apple in due course, but ... there is a crying need for Apple to move from a reactive mode of fixing security issues to a proactive one.

"I think [Apple's chief executive Steve] Jobs needs to copy what Bill Gates did when Windows was exposed in similar ways years back – he told everyone to stop what they were doing and address the issue.

"Since then Windows has had a much better security profile. Until then we advise our clients to be wary of using the browser until patches are applied."

John Girard, analyst at Gartner, warned: "iPhone users should be cautious about browsing unknown websites until this problem is resolved. The takeaway from this situation is to remember that all devices may contain flaws that will make them vulnerable to attack. It is wise to expect that more vulnerabilities will be found in the future on phone and PC platforms."

The German government warning came on the day the European Union Commission revealed it opted to supply employees with Apple iPhone devices due, in large part, to the security assurances it delivered in tests against other devices.

Apple's iPhone retains a respectable 28% share of the US smartphone market, figures released by analysts Nielsen show. Apple is second only to Research In Motion's BlackBerry, which has a 35% market share.

UK representatives for Apple were unable to be contacted before publication.