Security flaw allows unwanted code execution in Mailbox app

An Italian computer engineer has reportedly discovered that the popular Mailbox iOS app, which was acquired by Dropbox earlier this year, suffers from a potentially serious vulnerability that may allow malicious e-mails to wreak all sorts of havoc on your device. Macworld has confirmed that the flaw occurs in the latest version of Mailbox (1.6.2) currently available from the App Store.

According to Novara-based Michele Spagnuolo, the flaw allows JavaScript code to be embedded and executed from inside an HTML message; because Mailbox doesn't filter the data stored in the messages it displays, the code can be executed without any user intervention whatsoever. As Spagnuolo shows in a short video he shot for the occasion, this means that simply opening an e-mail message could cause a different app to be launched, and could allow third parties to foil "advanced spam techniques, tracking of user actions, hijacking the user by just opening an email, and, [...] potentially much worse things" on unsuspecting users.

The root cause of the problem is likely the fact that Mailbox uses a special Apple-provided control, called a webview, to render HTML messages. Since webviews are essentially self-contained versions of Safari, they also inherit all of the browser's capabilities--including support for executing JavaScript code.

The good news is that the problem is probably not as bad as it looks. The same issues that Spagnuolo highlights affect Safari itself, and were designed by Apple to provide some level of interoperability between Web pages and apps, like when an iTunes preview page automatically launches the App Store app.

Because iOS is tightly sandboxed, its security features are built with this functionality in mind and normally do not allow any potentially harmful operation to take place without the user's permission (at least as long as the OS is running on a device that isn't jailbroken). For example, just about any Web page can start a new SMS message, but the message can't be sent without user intervention. That said, if Mailbox exposes some internal functionality through its webview, an attacker might manage to exploit it and steal private information, or possibly launch a third-party app that could perform unwanted actions.

Luckily, the folks behind Mailbox should be able to fix this problem very easily; most modern e-mail clients, including the built-in iOS Mail app and Google's official Gmail software, for example, already filter HTML e-mails to prevent this kind of problem, and the techniques for doing so are well understood.

Mailbox representatives told Ars Technica that a fix for the issue is already in the works for a subsequent update of the app. Until then, however, it's probably best to be extra-cautious when using the app--or, even better, switch to a different client to be on the safe side.

Join the CSO newsletter!

Error: Please check your email address.

Tags emailAppledropboxsecuritymacworld

More about AppleDropboxGoogle

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Marco Tabini

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place