Apps used by millions of iPhone and iPad owners became vulnerable to snooping when a flaw was introduced into third-party code they used to establish HTTPS connections.The flaw was located in an open-source library called AFNetworking that’s used by hundreds of thousands of iOS and Mac OS X applications for communicating with Web services. The bug disabled the validation of digital certificates presented by servers when establishing secure HTTPS (HTTP over SSL/TLS) connections.This means that attackers in a position to intercept encrypted traffic between affected applications and HTTPS servers could decrypt and modify the data by presenting the app with a fake certificate. This is known as a man-in-the-middle attack and can be launched over insecure wireless networks, by hacking into routers and through other methods. The impact of the flaw for the iOS ecosystem was hard to gauge because the vulnerability only affected applications that used a particular version of AFNetworking—2.5.1—released on Feb. 9 and, of those, only the ones that relied on the library’s SSL/TLS functionality. The vulnerability was fixed in AFNetworking 2.5.2, released on March 26, so the flaw was active for a little over six weeks. How many iOS apps were updated to the vulnerable version in that time frame and how many of them used it for establishing HTTPS communications? A company called SourceDNA which tracks the use of third-party components in iOS and Android apps claims to have an answer.There are over 100,000 iOS apps, out of the 1.4 million on the App Store, that use the AFNetworking library, the company said Monday in a blog post. Of those, around 20,000 had been updated or released during the time when the vulnerability existed. SourceDNA created a signature for the vulnerable AFNetworking code and scanned those 20,000 apps to see how many of them had it. The scan showed that 55 percent used the older and safe 2.5.0 version of the library, another 40 percent were not using the library’s vulnerable SSL/TLS API (application programming interface) at all, and 5 percent or around 1,000 apps were vulnerable.One thousand vulnerable apps out of 100,000 might not sound too bad, but it actually is when taking into consideration that they included popular apps from high-profile vendors like Yahoo, Microsoft, Uber Technologies, Citrix and others.“It amazes us that an open-source library that introduced a security flaw for only six weeks exposed millions of users to attack,” SourceDNA said.Some vendors, including Yahoo, have already patched their apps, but others remain vulnerable, so SourceDNA created a website that allows users to check if their installed apps are vulnerable. Related content analysis IBM drops $6.4B to grab HashiCorp multi-cloud automation technology HashiCorp automation technology will fit into IBM’s Red Hat, watsonx, data security, IT automation and consulting businesses By Michael Cooney Apr 24, 2024 3 mins Cloud Architecture Private Cloud news Nvidia to buy AI orchestration software provider Run:ai Reported $700 million acquisition is aimed at helping AI users with workload management and resource allocation. By Jon Gold Apr 24, 2024 3 mins CPUs and Processors how-to Using the apropos command on Linux By Sandra Henry-Stocker Apr 24, 2024 3 mins Linux news 2024 global network outage report and internet health check ThousandEyes tracks internet and cloud traffic and provides Network World with weekly updates on the performance of ISPs, cloud service providers, and UCaaS providers. By Ann Bednarz Apr 24, 2024 38 mins Internet Service Providers Network Management Software Cloud Computing PODCASTS VIDEOS RESOURCES EVENTS NEWSLETTERS Newsletter Promo Module Test Description for newsletter promo module. Please enter a valid email address Subscribe