First crop of iPhone bugs - A chance for Apple to make a good impression

Robert Graham writing on the Errata Security blog details the first of iPhone bug.

The bug, discovered within minutes of activating the iPhone, was a Safari web browser bug, the same bug the company had found in the browser earlier.  The company also discovered that its Bluetooth fuzzer (a Bluetooth stack smasher) locked up the iPhone and it hopes that data from this will uncover more vulnerabilities.

Another vulnerability not mentioned is one that relates to AT&T in general, and that's the ease with which you can access someone else's voicemail because spoofing Caller ID on the network is a trivial process.

These bugs offer Apple a great opportunity to show how quickly they can respond to and patch bugs on the iPhone.  As Graham writes:

The thing that interests us most, though, is that we think the iPhone is inherently more secure than competing smartphones (such as those based on Windows Mobile or Symbian). While Apple is slightly behind Windows on the desktop/server (that Samba bug still appears to be unfixed), it's still light years ahead of the mobile vendors. The mobile market is completely screwed up right now: while carriers know about the widespread vulnerabilities in their phones, the carriers are unwilling to patch them.

Apple is taking a chance. Rather than allowing carriers like at&t/Cingular to control the mobile experience, Apple is controlling the experience through iTunes. Financial analysts on Wall Street are waiting to see whether this strategy will work.

...

We think Apple will win that battle. When we activated the phone, iTunes told us it was going to look for updates on July 5, 2007. That's a good sign. We've reported a vuln in a another smartphone 6 months ago that still hasn't gotten patched, mostly because that carrier doesn't want to. If Apple can push a fix for one of our bugs before this carrier fixes their bug, that might convince Wall Street that their strategy is better.

I think that Apple's decision to use iTunes as an update vehicle for the iPhone is both interesting and revolutionary.  It offers a mechanism for Apple to respond to security and non-security issues quickly and for users to be able to apply patches with little effort. 

However, when it comes to updates for the iPhone Apple will have to get things right first time and every time.  Hosing someone's iPod is one thing.  People become irritated but it's not a mission-critical bit of kit.  A cellphone is different.