iPhone insecurity

Apple excels in creative and innovative marketing. Often it's what they don't tell you that creates the most buzz. For example, we know next to nothing about the Apple iPhone. We know little about the new Leopard release of Mac OS X. Both have generated a lot of press, and so far the hype has succeeded in distracting everyone from a very real concern: the overall security of each. When you strip away all the creative marketing, when you take away the Steve Jobs' induced hype, what you have is a new mobile phone based around an operating system that is just as vulnerable as the next one. Trouble is, Apple isn't being as forthcoming about security as other vendors.
The naked iPhone
For the moment, iPhone will be running a version of the current Mac OS 10.4; in the fall, Apple will presumably upgrade its phones to the newer Mac OS 10.5. So far, the company seems to be rolling out a series of patches, one a month for last year or so, which is good. Apple might, however, want to follow Microsoft's lead and standardize its releases to the second Tuesday of each month.
When flaws are patched, Apple often does not acknowledge the researchers who actually brought the vulnerability to its attention. Apple is known to be looking for more security reserchers. It's not an ego thing; by working with the vendor to correct the vulnerability, researchers put in long hours, usually without compensation. A public "thank you" is more than enough. But that hasn't happened.

iPhone worries
Which brings us to the iPhone. Again, no one outside of an elite few has actually held an iPhone, yet there's legitimate concern about its security. But Jobs has said that it will be a closed operating system, meaning you cannot write mobile applications for it--directly. The carrot Jobs extended to the WWDC crowd was not a software development kit (SDK) for writing applications (which the developers I spoke to all wanted), but a way to write applets within the Safari browser.

As I have seen, security researchers were able to find fault with Safari 3.0 within days of its beta. Malware today is almost always financially motivated. The crowd that stands in line on June 29 for the 6 p.m. release of the iPhone has at least $500 to spend, more with the two-year contract to AT&T. These early adopters are going to load their iPhone with important contacts--maybe even download songs and movies that have value as well. In the end, the typical iPhone user may have a target on his back.