Identity Theft Vulnerability Affects All iPhones, Not Just Jailbroken Ones

A report surfaced recently about a vulnerability in Facebook that allowed people to access someone else's account. The report initially stated that this vulnerability only affected people on a jailbroken iPhone, however, that doesn't seem to be the case anymore as two new reports are stating that it isn't only jailbroken phones that are at risk.

Gareth Wright, an app developer from the U.K., along with The Next Web have each confirmed, separately, that this new vulnerability affects any and all iPhones, not just jailbroken ones. In addition to that, it has been discovered that the vulnerability originated in Facebook's iPhone app.

Wright released his report earlier in the week and claimed that the iPhone Facebook app includes a vulnerability that fails to encrypt log-on credentials whenever you get on Facebook on your iPhone via the app. Wright also said that he also discovered a Facebook access token in the Draw Something game. Wright copied the token, used the Facebook Query Language and extracted the information.

According to Wright's report, "Sure enough, I could pull back pretty much any information from my Facebook account." Wright also mentioned that the property list of the app contained any and all information needed to allow someone other than you to access your Facebook account, send private messages and do anything else imaginable.

However, Facebook is sticking by their claim that the vulnerability only affects jailbroken phones. In a statement from the social media giant, the company said, "Facebook's iOS and Android applications are only intended for use with the manufacture provided operating system, and access tokens are only vulnerable if they have modified their mobile OS (i.e. jailbroken iOS or modded Android) or have granted a malicious actor access to the physical device."

That may have been believable had The Next Web not released their very own report separate from Wright's. The Next Web confirmed themselves that the vulnerability also affects non-jailbroken phones. However, The Next Web also found that Dropbox also suffers from the same vulnerability, leaving the application open to a property list hack.

According to The Next Web, "We copied the .plist from one device, with the app installed and logged in, over to another which had a fresh installation of Dropbox on it. The profile copied and it worked seamlessly, as if we had logged on ourselves, which we had not." The Next Web also added that the Dropbox vulnerability works on phones that are passcode protected.

Facebook keeps saying that the vulnerability is only on jailbroken phones, though with the reports from Wright and The Next Web, I don't know how much longer the social media company can keep that story going.

Source: CNET - facebook ID theft impacts all iPhones, Dropbox

AOL Saves Nearly $5 Million by Decommissioning 10,000 Servers

In recent news it has been discovered that AOL has decommissioned nearly 10,000 servers, saving the company almost $5 million on its way to winning a competition that highlights the cost of running inefficient or underutilized IT equipment.

Nobody really realizes how much underutilized or inefficient servers can cost until they see the numbers. Decommissioning a 1U rack server could potentially save you $500 a year in energy costs, $500 a year in operating system licenses and $1,500 a year in hardware maintenance, and that's just one server!

Uptime Institute is behind the competition, which it is calling the Server Roundup Contest. Companies that participate could move workloads to newer, virtualized equipment or even into the cloud. In addition to that, each company had to provide paperwork to verify what they had done, which included work requests and recycling receipts and even photographs.

AOL decommissioned 9,484 servers over the past year, which accounted for nearly 1.4 of its worldwide servers. The savings included nearly $1.65 million in energy bills, $2.2 million in operating systems licenses and $62,000 in maintenance costs. AOL also gained $1.2 million from scrap and resale while reducing its carbon emissions by 30 million tons.

AOL was the best in the competition by far, beating out five other companies. The closest competitor was NBCUniversal, which removed 284 servers. However, AOL may have benefited from the fact that the company is in the middle of a multi-year effort to reinvent itself from an internet access provider to a content and advertising company. A majority of the servers AOL replaced were running applications and web properties that had become useless, according to the company.

Source: Computer World - AOL unplugs 10,000 servers, saves $5M