Robert Siciliano, a McAfee security expert, explains an SSL vulnerability affecting iPhones, iPads, and Macs. The flaw creates heightened risk on public Wi-Fi networks. Apple released a critical security patch, and users should assume their accounts may be compromised until they install it.
Chapters
All right, Sarah, thank you. Apple announced Friday that a major flaw in its software for mobile devices could allow hackers to intercept email and other communications that are meant to be encrypted. Experts say Mac computers were even more exposed. Now, Apple didn't say when or how it learned about the flaw or whether that flaw was actually being exploited. They did, however, advise people to run a software update on all of Apple devices that you own. So we want to know, what does this mean for those of us who own iPads, iPhones, and Mac computers? Joining me now, Robert Siciliano, Mac of the security expert. Thanks for being here.
Thank you.
Okay, we were just talking about an article we both read. Uh, John Hopkins University researcher said this is as bad as it can get for Apple. So let's start off, what exactly happened here?
So apparently there is a, a flaw with, uh, a, a secure socket vulnerability. It's basically, uh, when devices or OSes access the internet, there's a flaw in the security there that allows a bad guy to peek in on your, uh, internet communications, uh, generally on a wireless connection.
And you're So you're not talking about if we have wireless in our own home and it's protected. You're talking about in public spaces, like if you go to a coffee shop or somewhere where you're on a shared wireless network. Is that correct?
Correct. There is a certain amount of vulnerability for all of us, no matter what your devices are, when you're on a wireless network that's like a public, free, unprotected wireless network. But what they're saying is with this vulnerability that Macs and iOS, you know, iPads and iPhones, are even that much more vulnerable.
Okay, so I myself, I have an iPhone, I have an iPad. I don't have a Mac computer. But do I need to be worried about this? What should I do?
Yeah, everybody who owns an iOS device— I have an iPhone as well and an iPad— you need to download Apple's latest patch. Okay, it's a critical security patch designed to protect your device from this particular vulnerability.
Now, this just doesn't happen with Apple. I mean, they're, they're the one— Apple's and Mac computers are supposed to be safe. We talked a little bit about the virus situation, which is different, but, but how did this happen and why are they not really explaining what happened to the public?
It's very—
it's been very, um, you know, they, they've kind of kept a low profile about this.
Yeah, the information that's been released to the public is, is sketchy at best, uh, and we don't all really know entirely what's going on, and we may never know exactly what's going on, but chances are someone's going to get to the bottom line. Uh, meanwhile, consumers need to know that they are in fact vulnerable, that if they have an iOS device and/or a Mac, you need to update to the latest greatest OS operating system that they offer.
And if you have a Mac computer, that the, uh, in the intro I was saying that they were even more vulnerable.
So what are you supposed to do with the, with the Mac computer?
Computer, the same thing? Is there an update for that as well?
As well. Just like if you own a Microsoft Windows, you might go to Microsoft Windows Update to update your operating system. And with all of your Mac devices, generally Apple will push out an update for you. They'll send you some form of a notification, and when you receive that, within 28 to 48 hours, you probably should update.
Okay, this came out Friday. We're all sort of learning about it now. What do we do if we think maybe a hacker got into our information, we might not be sure yet, if we were at a coffee shop on our bank account, do we need to really be worried and go back and check our records and make sure that nobody's gone in there?
Yeah, so when I'm asked that question, I always say consider yourself breached.
Okay.
Consider yourself already breached. Consider your identity already at risk, which means that you should always be paying close attention to all of your active accounts, looking for account takeover, unauthorized activity, and refuting that activity as quickly as possible. So always pay attention to all of your accounts, always. Always keep all of your devices updated to latest, greatest operating system or browser, right? All your critical security patches. And monitor your social, right? Your Social Security number, via your credit reports. You know, have a good handle on your identity, whether it's from account takeover or from new account fraud at all times.
So whether we're sitting here thinking, oh my gosh, how could this have happened? Apple, I trusted, this never happens. You're saying no matter what, when you're using these on these devices, iPhones, iPads, computers, when you're getting on the wireless network, you just always have to consider yourself vulnerable in this day and age.
You wear your seatbelt driving because you know there's a chance you can get into a car accident. You should be paying attention to the security of your devices because chances are someday that your devices are going to get breached.
All right, well, thank you for that, Robert Siciliano, McAfee Online Security Expert. We appreciate it.
