Apps used by millions of iPhone and iPad owners became vulnerable to snooping when a flaw was introduced into third-party code they used to establish HTTPS connections.The flaw was located in an open-source library called AFNetworking that’s used by hundreds of thousands of iOS and Mac OS X applications for communicating with Web services. The bug disabled the validation of digital certificates presented by servers when establishing secure HTTPS (HTTP over SSL/TLS) connections.This means that attackers in a position to intercept encrypted traffic between affected applications and HTTPS servers could decrypt and modify the data by presenting the app with a fake certificate. This is known as a man-in-the-middle attack and can be launched over insecure wireless networks, by hacking into routers and through other methods. The impact of the flaw for the iOS ecosystem was hard to gauge because the vulnerability only affected applications that used a particular version of AFNetworking—2.5.1—released on Feb. 9 and, of those, only the ones that relied on the library’s SSL/TLS functionality. The vulnerability was fixed in AFNetworking 2.5.2, released on March 26, so the flaw was active for a little over six weeks. How many iOS apps were updated to the vulnerable version in that time frame and how many of them used it for establishing HTTPS communications? A company called SourceDNA which tracks the use of third-party components in iOS and Android apps claims to have an answer.There are over 100,000 iOS apps, out of the 1.4 million on the App Store, that use the AFNetworking library, the company said Monday in a blog post. Of those, around 20,000 had been updated or released during the time when the vulnerability existed. SourceDNA created a signature for the vulnerable AFNetworking code and scanned those 20,000 apps to see how many of them had it. The scan showed that 55 percent used the older and safe 2.5.0 version of the library, another 40 percent were not using the library’s vulnerable SSL/TLS API (application programming interface) at all, and 5 percent or around 1,000 apps were vulnerable.One thousand vulnerable apps out of 100,000 might not sound too bad, but it actually is when taking into consideration that they included popular apps from high-profile vendors like Yahoo, Microsoft, Uber Technologies, Citrix and others.“It amazes us that an open-source library that introduced a security flaw for only six weeks exposed millions of users to attack,” SourceDNA said. Some vendors, including Yahoo, have already patched their apps, but others remain vulnerable, so SourceDNA created a website that allows users to check if their installed apps are vulnerable. Related content opinion Can your cloud backup provider fail? Cloud backup providers aren’t infallible. Be sure to ask hard questions of providers about their storage redundancy, geo-replication, data integrity measures, and disaster recovery capabilities. By Curtis Preston Apr 19, 2024 7 mins Backup and Recovery Cloud Computing Data Center news Cisco marries AI and security with cloud-based data center offering Cisco announces AI-based Hypershield, a self-upgrading security fabric that's designed to protect distributed applications, devices and data. By Michael Cooney Apr 18, 2024 5 mins Network Security Data Center how-to Shredding files on Linux with the shred command The shred command is a good option for removing files from a Linux system in a way that makes them virtually impossible to recover. By Sandra Henry-Stocker Apr 18, 2024 4 mins Linux news Intel announces edge AI processors New edge-optimized processors and FPGAs will power AI-enabled devices in vertical industries including retail, industrial and healthcare. By Andy Patrizio Apr 18, 2024 3 mins CPUs and Processors Edge Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe