The Download Blog

Another iPhone worm has been spotted in the wild.

Unlike the previous exploitation, which merely changed a jailbroken iPhone's wallpaper to a picture of Rick Astley of "Rickrolling" fame, this new threat allows hackers to steal sensitive information.

According to security firm Sophos, which wrote about the exploitation after a Dutch ISP spotted it late last week, the worm attacks jailbroken iPhone and iPod Touch devices only.

The worm "uses command-and-control, like a traditional PC botnet," Sophos wrote in a blog post on Saturday to warn users about the exploit. "It configures two startup scripts, one to execute the worm on boot-up, and the other to create a connection to a Lithuanian server to upload stolen data and cede control to the bot master."

Jailbreaking, which has been around for about two years, is a hack that enables iPhone and iPod Touch users to download applications unavailable through Apple's App Store.

Sophos wrote that the worm attacks users on several ISPs, including UPC in the Netherlands, Optus in Australia, and T-Mobile in several countries worldwide. Worse, the worm spreads faster on a Wi-Fi connection than a 3G connection. Users with affected devices might notice extremely short battery life while on Wi-Fi. According to Sophos, that's mainly due to the worm engaging in "so much network activity."

When a device is infected, it's assigned a unique number so that the attackers can easily pinpoint a single device. It also looks for authentication systems that use SMS, better known as mTANs. mTANs are frequently used by banks that send an SMS message with a password to mobile phones, allowing people to log in to their online accounts, Sophos wrote.

In essence, this threat is serious.

Sophos recommends that people with infected iPhones and iPod Touch devices restore them back to Apple's most recent firmware update. For now, there is no other way to fix the problem.

Firefox has a CPU usage issue and, consequently, can cause overheating problems in some laptops, particularly ultraportables. That's what I've found over the last couple of years.

But don't take my word for it. This is documented on a Mozilla support page entitled "Firefox consumes a lot of CPU resources." The page states: "At times, Firefox may require significant CPU [central processing unit] resources in order to download, process, and display Web content." And forum postings like this one about a Dell Netbook are not uncommon: "Mini9 would get way too hot."

The Mozilla support page goes on to say that "you can review and monitor CPU usage through specific tools" and describes ways to limit CPU usage, such as: "A Firefox add-on, called Flashblock, allows you to selectively enable and disable Flash content on Web sites."

Let me describe my experience. I find that tab for tab, Firefox uses decidedly more resources than other browsers--Safari, for example. And in the past (when I was actively using a Windows Vista-based machine) Firefox also compared unfavorably with Microsoft's Internet Explorer for CPU usage.

More specifically, here's the behavior as I see it. When I'm accessing sites with multimedia content such as the CNET front door, Firefox CPU usage will bounce around between 30 and 60 percent, and sometimes spike higher (80 percent and above), as indicated by the Mac OS 10.6.2 Activity Monitor.

On the other hand, the Safari CPU usage with the same pages open is much lower--typically between 2 percent and 10 percent.

My theory is that most users don't notice this because in mainstream laptops, this isn't an issue. But it can become an issue in ultraportables--typically under an inch thick--which are more sensitive to heat because of the design constraints. The ultrathin Apple MacBook Air, which I use as my main machine, is a good example.

The fan is usually an audible indicator of CPU usage issues. When I'm using Firefox and I have tabs open on multimedia-rich sites (which is par for the course these days), the Air's fan will almost invariably kick on and stay on until I close the tabs. As I write this, the fan has finally shut down after I closed the Firefox tabs (e.g, CNET front door). Those same tabs in Safari are still open and not causing any significant spike in CPU usage or fan activity.

When I contacted Mozilla, a technical support person guessed that Safari is possibly better at optimizing Flash-based sites compared to Firefox. And that may be true. However, I had similar issues before when I was using a Hewlett-Packard business ultraportable (also very thin like the Air) that were not necessarily tied to Flash usage. In short, Firefox was less efficient with CPU usage compared to Microsoft's IE 8. And the behavior was similar. The HP laptop would quickly heat up and the fan would kick on.

Finally, let me reemphasize that I'm guessing that most users don't notice this because heat dissipation is not a big issue for mainstream laptops that are not necessarily thermally-challenged when accessing multimedia-rich Web pages. That said, this has been a steady problem for me because I use ultraportables almost exclusively and has forced me to limit my use of Firefox.

(Credit: CNET)

With more than 100,000 apps in the iTunes App Store and huge success around the world with the iPhone, it would appear Apple has done just about everything right with the launch of its first mobile handset. But as any iPhone app developers will tell you, the app approval process is less than ideal, with some developers waiting well beyond Apple's 14-day waiting period and sometimes longer to get their apps approved. Though Apple has stated it is working on the app approval process, there has been little in the way of progress if you ask iPhone app developers.

Recently, Apple added an automated system for weeding out developers who use Apple's private APIs, a process that may be part of a larger plan to cut down on some of the wait time. Unfortunately, developers are still struggling to get their apps to the iTunes store, finding out at the end of the 14-day waiting period that it was the automated system that turned them down. Hopefully, as more time passes, Apple will be able to figure out a way to make the process more efficient while still being able to provide high-quality and secure apps for everyone. Happy iPhone app developers mean more and better apps, so it's in all of our best interests for Apple to make the process better.

This week's apps include a new (to iPhone) multiservice chat client and a stunt-racing game with beautiful 3D graphics.

Use the tabs at the top to switch conversations

(Credit: Screenshot by Jason Parker/CNET)

Trillian ($4.99) is a popular multiservice chat client on Windows machines that you can now use on your iPhone. Multiservice chat clients are ideal for those who have accounts across several services like Yahoo, Google, ICQ/AIM, and MSN, and want to use just one client to access them all. The interface is fairly intuitive, letting you add your user names and passwords for each service, and then letting you log on to all or specific services with only a few taps on your touch screen. Trillian does not support landscape mode for typing yet, but the developers say it is coming soon.

Once you're logged in, the Trillian interface looks a lot like it does in the Windows client, complete with your buddies' avatars, contact categories (friends, coworkers, etc.), and color-coded icons to indicate which service your friends are using. The way Trillian handles multiple chat sessions on the iPhone client is excellent, with a touch-scrollable tabbed interface, making it easy to switch conversations quickly. Also especially useful (and clever) is the push notification system, that sends you the first message of a chain so you know someone is trying to reach you, but doesn't send a huge list of messages when you don't want them. At this time, you can only stay logged-in (with the app suspended) for a maximum of 24 hours, but the folks at Trillian say it will be lengthened to seven days in future updates. Though the price is a little steep in my opinion, Trillian is a high-quality chat client that will appeal to those who use multiple services.

The screenshot doesn't do it justice, but this game looks and plays great

(Credit: Screenshot by Jason Parker/CNET)

Jet Car Stunts is a stunt-racing game that runs surprisingly smoothly on first gen iPhones on up to the 3GS. Beyond the beautiful graphics, the driving control system is excellent, using the accelerometer for steering and onscreen controls for gas and brakes. What makes the game unique from other racing games are the controls for your rocket boost to complete big jumps, and the braking system that works both on the ground and in the air.

You can choose from two different game types including Time Trial and Platforming. In Time Trial, you race five laps around a track with corkscrew twists, tight turns, and huge jumps, to qualify for bronze-, silver-, or gold-medal times. Platforming has no time limit, but instead records the number of tries it takes you to complete difficult tracks--and they get very difficult in both game types. Time Trial has three skill levels, with four tracks to complete in each to move on the next skill level. Platforming has five difficulty levels, with five tracks in each to pass before moving on. Overall, Jet Car Stunts is one of the more unique racing games and features excellent graphics, extremely smooth controls, and plenty of replay value, with increasingly challenging tracks. I've had the game for a week and I still can't get over both how good it looks and how smooth it plays.

What's your favorite iPhone app? Were you waiting for a big-name multiservice chat client like Trillian before spending your money? Is Jet Car Stunts hard or am I just not good enough? Let me know in the comments!

Amidio makes some heavy-duty musical apps for the iPhone and iPod Touch; I was particularly impressed with StarGuitar, which gives you a virtual guitar with a bunch of preset rhythms, letting songwriters create quick sketches of ideas when they're nowhere near a guitar.

I created a nice vocal loop from the new Beach House single, then dropped it into Pink Floyd's "Astronomy Domine." It took me about five minutes.

On Tuesday, Apple approved a new Amidio app, called TouchDJ, for the iPhone and iPod Touch, and it's both very impressive from a technical standpoint and a heck of a lot of fun. The iPhone can only play one audio track at a time, but TouchDJ essentially fools it into placing two MP3s side by side for simultaneous, real-time manipulation and playback. It's like a two-track digital DJ setup right on your iPhone.

You get a crossfader to control the balance between the two tracks, plus individual controls for each track's volume, pitch/speed (which aren't independent from one another, unfortunately), equalization (three bands), and effects (the built-in real-time effect sounds like a kind of flanger, and there are several lame samples of a low-pitched robot voice, but you can upload your own). Each track is represented by simple waveform images that use a different color for the bass, which helps you match beats more effectively. A tempobend effect, which lets you quickly bend the speed up or down on either track, also helps you get in sync.

The looping functions were most impressive--you can create a cue and loop mark at any point in either track, then return to the cue with the rewind button, move to the loop mark with the fast forward button, or create an endless loop between the two points. All of this is in real time. If you've got an audio splitter, you can even create a separate cue track for your headphones--for example, to set up a loop in your second track while the first one is playing, without exposing your experimentation to your audience--although this requires some serious processing power, and is recommended only for an iPhone 3GS.

There are a couple caveats.... Read more

Internet Explorer 8, Firefox 3, Google Chrome 4, Apple's Safari 4, and Opera 10 include features that block sites known to host malware and malicious downloads. All but Opera also let you browse without leaving any tracks. But just as important as these protections is ensuring that whichever browser you use is thoroughly patched.

Filtering out bad sites
Firefox's built-in antiphishing tool claims to update its bad-site database 48 times a day, according to Mozilla's Firefox security page. Firefox 3 uses Google's Safe Browsing service to automatically block sites that are known to host malware. The Google Code site describes how Safe Browsing works in Firefox.

To verify that attack-site blocking is enabled in Firefox, click Tools > Options > Security and make sure "Block reported attack sites" is checked.

Firefox will prevent known-bad sites from opening when "Block reported attack sites" is checked.

(Credit: Mozilla Foundation)

The same feature is built into Google's own Chrome browser. You can ensure that malware-site filtering is on in Chrome by clicking the wrench icon in the top-right corner, choosing Options, and selecting Under the Hood. "Enable phishing and malware filtering" should be checked. The Google Chrome Help site describes the feature. (Hint: This page looks very similar to the description on the Google Code site.)

Google's Chrome browser blocks known-bad sites when "Enable phishing and malware protection" is checked.

(Credit: Google)

The SmartScreen technology in version 8 of Internet Explorer blocks known-malicious downloads as well as bad URLs. Other new security features in IE 8 include automatic blocking of click-jacking and cross-site scripting attacks, automatic crash recovery, and highlighting of the actual domain name in the address bar. The Microsoft Security site describes the SmartScreen Filter and includes links to a SmartScreen FAQ and information for site managers.

Apple's Safari browser added phishing and malware blocking in version 3.2, which was released in late 2008; read about this and other security features in Safari 4 on the Apple Safari site. Likewise, Opera's Fraud Protection predates the phishing and malware filters in IE and Firefox and is enhanced in the latest version 10. But attack-site blocking is only one of Opera's many security features, which you can read about on the Opera site.

Browsing in private
To activate private browsing in Firefox 3, click Tools > Start Private Browsing, or simply press Ctrl-Shift-P. You can set Firefox to start in private-browsing mode by clicking Tools > Options > Privacy and check "Automatically start Firefox in a private browsing session." The Mozilla support site provides more information about this feature. Likewise, put IE 8 in private-browsing mode by clicking Safety > InPrivate Browsing, or by pressing Ctrl-Shift-P. You can also open a new tab and click either Browse with InPrivate or Open an InPrivate Window.

IE 8 also lets you control the information about your browsing habits that's shared with Web tracking services. To activate this feature, click Tools > InPrivate Filtering Settings and choose "Let me choose which providers receive my information." This opens the InPrivate Filtering settings dialog, where you can turn filtering off, choose which services to block from tracking you, or automatically block all trackers.

Internet Explorer 8's InPrivate Filtering lets you block some or all Web tracking services.

(Credit: Microsoft)

You can open an incognito window in Google Chrome by clicking the wrench icon in the top-right corner and choosing "New incognito window," or simply press Ctrl-Shift-N. The incognito icon (a shadow figure in a fedora and glasses) appears in the top-left corner of the browser window. The Chrome support site offers a more detailed description of this feature.

Opera lacks an equivalent private-browsing capability but does offer private searching and other identity-blocking features, as described on the Opera site. To activate private browsing in Safari, simply click Safari Settings Menu > Private Browsing.

Automatic and not-so-automatic browser updates
Patching is a way of life with nearly all software, but especially with browsers and the media players associated with them: Adobe Reader, the Flash Player, Apple's QuickTime, and Sun's Java, among others. All of a browser's security features can be rendered useless by a piece of malware that takes advantage of an unpatched hole in the program.

Firefox 3 alerts users to the presence of an update and now also notifies you when your Flash Player is out-of-date. Internet Explorer 8 updates via the Windows Update/Microsoft Update services. Google Chrome made a splash by being the first browser to update itself in the background without requiring any prompting from users. Safari updates automatically via Apple's update service, which also serves up patches automatically for QuickTime, iTunes, and other Apple software. Opera also notifies you automatically when a new version is available.

But updating is too important to leave to others. Back in April, I described Secunia's Online Software Inspector and downloadable Personal Software Inspector, which identify out-of-date programs on your PC. The programs mentioned in that post have all been updated since, but Secunia's services should point you to the most recent versions.

(Note that Secunia sometimes reports a program as being out-of-date when in fact you have the latest version. On my PC, it continually reports my up-to-date Flash Player as being in need of an update, for example. But the free service Secunia provides is worth putting up with this and similar minor annoyances.)

Trillian IM is finally available to iPhone users.

(Credit: Trillian)

It took a few months, but finally, Trillian IM is available to iPhone and iPod Touch users through Apple's App Store. The application costs $4.99.

Cerulean Studios, the company that created Trillian, said that Trillian for iPhone sports several features users will already find on the company's desktop software. The app displays contacts, grouped and sorted by their respective categories. Users can also view multiple chat windows in a tabbed display. Thanks to updates Apple has made to the iPhone and iPod Touch, Trillian for iPhone also supports copy and paste. As with Trillian for the desktop, users can set their status, choose an avatar, and set up different status messages.

Because the app is always connected to Cerulean Studios' Astra server, users can synchronize content across multiple IM clients. In other words, any changes made on the iPhone version of the app will immediately be reflected on the company's Windows client and the user's Astra profile. Any contacts users add will also be synchronized with their other clients.

According to Cerulean Studios, all chats are maintained on the server, so they are kept in case of a lost connection. The app will also alert users when they receive an instant message, regardless of whether Trillian for iPhone is open or not. When an IM is received, users will see a dialog box, hear the Trillian IM-notification sound, and be able to start Trillian and reply to the person.

Those interested in using Trillian for iPhone will first need a Trillian Astra account. Luckily, the iPhone app allows users to sign up for Astra from within the app.

(Credit: CNET)

Like I've mentioned here several times before, I'm one of the people who is still using the iPhone 3G. Like many, I'm waiting for my two-year contract to be up so I can get whatever the next-gen iPhone is. It doesn't bother me too much (aside from a few app features that require 3GS), but I do long for the faster processing power and extra features found in the latest iPhone. Especially when it comes to (surprise!) games.

To give you an idea of the difference between the two iPhone processors and how they effect game performance, fellow CNET editor, Josh Lowensohn, put the two iPhone models to the test. In Josh's article, he offers up several side-by-side comparisons of many of the top iPhone games with analysis. If you're an iPhone-gaming fan or just want to see how the processing power matches up between the two models, check out his article.

This week's apps are both games, with the first complete basketball game for the iPhone and a fun sequel to one of the more unique games in the iTunes App Store.

I hope Ellis doesn't pass it to the guy with the green square around him

(Credit: Screenshot by Jason Parker/CNET)

NBA Live ($9.99) is the first fully licensed and complete basketball game for the iPhone and iPod Touch. You can play as any of the 30 NBA teams featuring the actual players and stats. You can play a quick exhibition game, play through an entire season, or just play through the playoffs up to the NBA Championship. The control system includes an onscreen joystick for movement and two buttons that take care of most basketball action (shooting, passing, etc.), but with a clever system for pulling off more advanced moves. The graphics are not on par with what you'll find in the current basketball games on consoles, but for an iPhone game, it looks fairly good and plays well enough to satisfy basketball game fans.

NBA Live packs a lot of features into the game using only a couple of buttons. Advanced moves like cross-over dribbles and hardcore dunks require you touch a button then flick in a direction. Holding down on the pass button brings up icons you can touch to pass to specific players. If you want to go deeper than just running and gunning, you can touch the clipboard icon to call a play and set up an open man for an easy shot. While I'm happy with NBA Live as an iPhone basketball game, I may be spoiled by the smooth experience on console versions. The graphics are pretty good, but not great and the movement can be a bit jerky. Overall, I think it's a pretty good basketball game, but it might be worth waiting a little while to see if it goes on sale. Hardcore fans should get this game.

The simple, hand-drawn graphics are part of what makes this game charming.

(Credit: Screenshot by Jason Parker/CNET)

JellyCar 2 is the sequel to the unique squishy driving-puzzle game, JellyCar. JellyCar 2 expands on the hand-drawn, cartoon puzzle game with several more levels, new game types, and the capability to customize your car and create your own levels. The controls involve touching the screen on either side to go forward and backward and you can tilt your iPhone to right your car when it flips over. Play the game in the Classic Mode to navigate your car through a level to the goal in the least amount of time. You have three skill levels in classic mode with a number of tracks for each level. Long Jump mode lets you drive down a long ramp and use obstacles in the level to project your car the longest distance. The third mode adds a new game entirely, requiring you to direct Tetris-like puzzle pieces to their associated bins--strange sounding, but it's pretty fun with the JellyCar physics in play. Adding to your options for solving puzzles, you can touch the car to "go big" like the original JellyCar. You also get two extra skills you can grab while driving: a balloon that lets you take to the air and one that makes your wheels sticky--each of which you will use at different times to pass levels.

JellyCar 2 also adds a few other features to play with and will amount to a lot of replay value. You can customize your vehicle and wheels with different colors, but you can also choose different vehicles, each with their own physical properties to change how you attack various levels. A new editing mode even lets you create and save your own levels from the ground up. Overall, I think JellyCar 2 is in a class by itself, with a fun, stylistic feel to the game and plenty of challenging levels that are very enjoyable to play.

What's your favorite iPhone app? Do you think NBA Live is worth the price to play? Is JellyCar 2 a worthy sequel to JellyCar? Let me know in the comments!

Apple quietly launched a new preview service this week that makes it easier for users to view its iTunes music library from the browser.

Dubbed iTunes Preview, the new feature allows visitors to view iTunes content from their browser without being forced to launch iTunes. Previously, when a Web user received an iTunes link, they needed to open iTunes to view its content.

As part of the launch, Apple has updated links in iTunes to redirect to iTunes Preview. When a user copies a link in the software and pastes it into the browser, they will be brought to the song's individual listing on Apple's Web site. The feature is especially handy for those who don't use iTunes, since they can now view an individual song without being forced to download the software.

Aside from individual music listings, iTunes Preview also allows users to sift through artists and albums based on genre. Each individual listing displays all the songs in an album, the album art associated with it, its cost, and other content typically found in the iTunes store. The page also includes a link to the iTunes store in case the viewer wants to buy it. That said, there aren't any song previews in iTunes Preview; users will still need to go to iTunes to hear them.

iTunes Preview in action.

(Credit: Screenshot by Don Reisinger/CNET)

For now, iTunes Preview features music. There's no telling if Apple will add more content over time. If you want to check it out, copy an iTunes link from within the software and paste it into your browser.

(Via AppleInsider)

Apple released a security update for its Safari Web browser on Wednesday. Available for Windows and Mac, Safari 4.0.4 plugs what sound like moderate to severe security holes. Unlike competitors Internet Explorer, Firefox, and Chrome, Apple doesn't rate the severity of its security fixes.

The security fixes address a wide range of problem points. On both Windows and Mac, parsing maliciously written XML content could have led to a browser crash, using shortcut menu options within a maliciously created Web site could have led to the disclosure of local information, and visiting a maliciously built Web site could have resulted in unexpected actions on other opened Web sites.

For Windows only, viewing a maliciously made image with an embedded color profile that could lead to a browser crash or running arbitrary code is no longer a threat, nor is accessing a maliciously crafted FTP server, which could have led to an unexpected crash, information disclosure, or arbitrary code execution. For Mac only, an exploit that could have allowed e-mail to remotely load audio and video content when loading a remote image has been disabled.

Although it's good practice to update a program whenever a security fix has been released, more transparency from Apple on the matter would pull the company up to competitors' standards.

Click here to read the full changelog for Safari 4.0.4.