Apple's SSL vulnerability let hackers intercept encrypted traffic on iPhones, iPads, and Macs. Robert Siciliano, a McAfee security consultant, explains the bug and how to patch it. iOS updates were rolling out, but Macs stayed vulnerable at the time.
Chapters
Get back to that, Kevin. Thank you. No doubt you've heard about it— Apple announcing a bug that left Apple devices susceptible to hackers. The good news, it does have an easy fix. Live at our Beacon Hill studio to talk more about it is Robert Siciliano. He's the identity theft expert and McAfee consultant. So Robert, can you tell us more about this bug and all that goes along with it?
Yeah, this is a, a big deal. This bug allows, um, bad guys to bypass the encryption that, uh, financial websites and social media websites, and even your email provider websites provide. It allows the bad guy to basically see all that information that is supposed to be encrypted.
I noticed today on my settings the one and was alerted to it having read about it. How long has this been out there as far as a problem?
So Apple is being very tight-lipped about this. It could be years that this has gone on and it was just discovered. It is— they're pushing pushing out patches for devices as far back as iOS 6.
What about the personal information? I mean, tell us a little bit more about that and what exactly could be compromised here.
So think of every time you log into a financial site like online banking, or every time you log into social media like Facebook or others, or even when you log into either Gmail or Hotmail or Yahoo. All of those sites are encrypted, meaning in the address bar it says HTTPS. That means it's a secure, secure site. What this bug allows is for bad guys essentially to see all that data. So the encryption becomes null and void. Uh, bad guys can also set up websites that may look like those sites and, uh, basically get all of your credentials, your usernames and your passwords, like a man-in-the-middle type attack.
This is a big deal. I mean, the more you talk about it, the more it strikes fear in anyone who owns one of these products by Apple.
Right.
And what isn't out of bounds here as far as Apple is concerned? What— are the newer devices safe? Or no?
So basically all of your iOS, which is your iPads and your iPhones, and all of your Macs, you know, your laptops or desktops, are all vulnerable. Currently the patch is available for your iDevices, your iPads and your iPhones, but there's nothing available for your Macs. So everybody at this point is vulnerable unless of course they've installed the patch. But your Macs, there is no solution yet. They haven't pushed that out yet.
Wow, so the Mac computers still were— we're still vulnerable?
Correct.
Wow, alright, now iPhone, iPad users, what can they do to see if they've been hacked at this point?
So the, uh, I think it's important that everybody, you know, download whatever patch is available. They're pushing that out. You have to make sure you have enough space on your device to download it because it's as big as a gigabyte, which is kind of crazy for a patch. As far as your existing accounts go, make sure to monitor all of your existing accounts. Monitor your email, monitor your financial accounts, monitor all of your social accounts, looking for any unauthorized transactions or unauthorized activity. One thing that people on Macs can do is if you are on a wireless connection like a laptop, there's a tool, a company I work with called Hotspot Shield, which encrypts all of your wireless communications. That's one solution that's available to you right now, but really the most important thing The first thing is to monitor all your different accounts and to download any patches that Apple pushes out.
You know, it seems unique for Apple to be involved in a mess like this. Typically they're pretty good about that stuff, but why haven't they said more? Why are they being so tight-lipped? This doesn't seem like Apple at all.
Yeah, this, this is very unusual for a company like Apple to be engaged in such a vulnerability. And the fact that they're tight-lipped about it means that they're really just getting a handle on it. Security researchers had discovered this vulnerability very recently and basically, you know, dropped a dime, and Apple's playing catch-up on it. You know, Apple's a great company. You know, who doesn't love Apple? And this is, this is going to hurt them just a little bit, and they'll recover from it. I mean, security is a significant part of the way in which they do things, but with technology, you know, there's always going to be some type of a vulnerability. I mean, there's so many moving parts here. And the person who was responsible basically for this code, uh, you know, they're gonna get a lashing, I'm sure, uh, and, uh, they'll fix this, and going forward they'll learn from it.
Very good. We're gonna have to leave it at that, but good for anyone who owns Apple products to know. And as you've always said, you gotta pour over your accounts time and time again just to make sure everything is right. Robert Siciliano, identity theft expert, McAfee consultant. Appreciate your time today.
Thanks, Doctor.
Well, so if you have an Apple device, fixing all this couldn't be much easier. Fox 25 web producer Jess Silva shows us how.
You need to update your iPad or your iPhone but you don't know how to? Here I am with a little explanation. So you're gonna go into Settings, you're gonna go into General here, and then right here you're gonna see Software Update, and you will find a little link there. I'm Jess Silva with myfoxboston.com.
