JailbreakMe 3.0 and the iOS PDF Flaw: Protect Your Business

07.07.2011

It's important to note that to date, there have been no in-the-wild examples of the PDF flaw being exploited, aside from JailbreakMe. However, until there's an iOS update that deals with the potential nightmare of malicious third parties getting unfettered access to sensitive corporate data on iOS devices, there are some common-sense steps to take.

The bug concerns how fonts in PDF documents are handled in the Safari Web browser on iOS devices. In other words: A PDF document must be opened via Safari on the device for the attack to be executed.

Until there's a fix in from Apple, it would be wise to make sure those using iOS devices in your business are aware of this flaw and how to mitigate the risk. A reasonable policy would be to be wary of opening PDFs on the device--a more severe approach would be to outlaw using iOS devices for PDF files at all until further notice.

But it's important to note that the bug only pertains to the Safari Web browser--PDFs sent by mail and opened in a specific app capable of reading the file are not vulnerable in the same way. If your users can be trained in this difference and to recognize the danger signs, they should still be fine firing up PDF files in their favorite app.

But beyond avoiding PDF files, the flaw and the launch of JailbreakMe 3.0 bring back the ongoing debate of whether or not to jailbreak iOS devices. It's tempting, especially on personal devices, because of the range of software and .