Micro-Star International (MSI) has announced it will release new BIOS files for its motherboards following the discovery of Secure Boot settings that left approximately 290 of the company’s motherboards vulnerable to malware.

Motherboards made by the company came with insecure security options by default, in a setting that the firm has now committed to changing in a future update.

Security researcher Dawid Potocki was the first to publish findings on the vulnerability after discovering that his firmware accepted any OS image, whether or not it carried a legitimate signature.

Potocki discovered that MSI had set its Secure Boot as ‘Enabled’, but the default on motherboards was ‘Always Execute’ resulting in any OS image being accepted by the firmware.

Users seeking the Microsoft-recommended Secure Boot settings would have to manually go into motherboard settings and change ‘Image Execution Policy’ to ‘Deny Execute’.

Secure Boot is a firmware process that protects the Unified Extensible Firmware Interface (UEFI), the internal architecture that handles the booting of operating systems within a computer. It validates the safety of files launched when a device starts by verifying each carries a valid signature and kills processes that fail these checks.

Threat actors that compromise core systems could take full control of a victim’s machine, leading to extensive data loss, or install malware such as a rootkit that persists even after a full system reinstall.

An MSI spokesperson told IT Pro that the choice to roll out the decreased security measures came about after a review of “the product characteristic of our motherboard and target audience in the consumer market”. The firm stressed that it is in compliance with Microsoft's design guidance.

“We preemptively set Secure Boot as Enabled and 'Always Execute' as the default setting to offer a user-friendly environment that allows multiple end-users flexibility to build their PC systems with thousands, or more, of components that included their built-in option ROM, including OS images, resulting in higher compatibility configurations,” MSI stated on its dedicated subreddit.

“In response to the report of security concerns with the preset bios settings, MSI will be rolling out new BIOS files for our motherboards with 'Deny Execute' as the default setting for higher security levels.

“MSI will also keep a fully functional Secure Boot mechanism in the BIOS for end-users so that they can modify it according to their needs.”

When IT teams or individual users can expect to receive the update has not been revealed by MSI.

The post on its subreddit has already received critical responses, pointing out that the insecure default settings were not made clear in any of the firm’s BIOS update changelogs.

The full list of affected motherboards was listed by Potocki on a GitHub repository in December, along with instructions for manually fixing the issue.

Potocki identified that the issue was first introduced in an update released around Q3 2021, but was unable to determine the specific version.

In November 2022, Lenovo patched ThinkPad, Yoga, and IdeaPad devices due to a vulnerability that allowed for UEFI Secure Boot to be deactivated.

At the time, concerns were raised over the potential for businesses to fall vulnerable to malware such as ransomware through the vulnerability, particularly given the propensity for laptops such as these to be used in an office environment.

Intel has expanded its $100,000 bug bounty program in an effort to entice “elite hackers” to report vulnerabilities in the company's firmware, hypervisors, graphics processing units (GPUs), and chipsets.

Of the 113 external vulnerabilities detected in 2021, 97 were reported to Intel through its public bug bounty program.

Dubbed Project Circuit Breaker, the expansion to Intel's existing program will see the creation of an integrated community that will offer targeted training, hacking challenges, and opportunities to explore new and pre-release products, in addition to enhanced collaborations with hardware and software engineering teams at Intel.

"Project Circuit Breaker broadens and deepens Intel's existing open Bug Bounty program by hosting targeted time-boxed events on specific new platforms and technologies, providing training and creating opportunities for more hands-on collaboration with Intel engineers," explained Intel.

"Project Circuit Breaker's first event, Camping with Tigers, is already underway with a group of 20 researchers who received systems with Intel Core i7 processors (formerly Tiger Lake)."

In the exclusive Camping with Tigers event, researchers will look for security vulnerabilities in Intel’s Tiger Lake platform. The program began in December 2021 and will be in effect until May 2022. At three milestones, eligible vulnerabilities will earn bounty multipliers.

Potential findings may include, among others, micro-architectural and firmware vulnerabilities. This covers flaws related to BIOS, IP firmware components, embedded controller, sensor, trusted platform module, and flash storage.

“We invest in and host bug bounty programs because they attract new perspectives on how to challenge emerging security threats – and Project Circuit Breaker is the next step in collaborating with researchers to strengthen the industry’s security assurance practices, especially when it comes to hardware, said Katie Noble, director of Intel’s product security incident response team (PSIRT) and bug bounty.

“We look forward to seeing how the program will evolve and to introducing new voices to the meaningful work that we do,” added Noble.

Apple has patched a raft of bugs affecting iOS 13 less than a week after releasing the latest version of its flagship mobile operating system.

iOS 13.1 provides several fixes and improvements, addressing problems with AirDrop with Ultra-Wideband technology on the latest set of iPhones, for example. The Calendar, Notes and CarPlay apps are also receiving minor fixes.

Additional features expected in the release, meanwhile, including suggested automation on Shortcuts, and the ability to share one's estimated time of arrival (ETA) in its Maps app.

After releasing iOS 13 last Thursday, iPhone users complained about problems with the Mail app, whereby there have been incorrect download counts, missing senders and subjects, and difficulty selecting threads. There were also issues that prevented downloading email messages in the background.

The battery, too, has received attention, with iOS 13.1 slowing the rate of aging by reducing the time an iPhone spends fully charged. The iPhone XR, Xs, and Xs Max will also benefit from a "performance management" feature that prevents the devices from unexpectedly shutting down.

One of the key features packaged into iOS 13 was a Dark Mode that drapes the user interface (UI) in shades that may appeal more to users in dimly-lit conditions. With iOS 13.1, Apple has resolved a bug in which wallpapers were prevented from switching appearances during the transition between Light and Dark modes.

Despite a raft of tweaks, there hasn't yet been a fix to a major bug that allows third-party digital keyboard developers to gather keystroke data and send it back to their servers, regardless of user permissions.

"Third-party keyboard extensions in iOS can be designed to run entirely standalone, without access to external services, or they can request 'full access' to provide additional features through network access," the company said.

"Apple has discovered a bug in iOS 13 and iPadOS that can result in keyboard extensions being granted full access even if you haven't approved this access.

"This issue does not impact Apple's built-in keyboards. It also doesn't impact third-party keyboards that don't make use of full access. The issue will be fixed soon in an upcoming software update."

iPhone, iPad, and iPod touch users who may be affected by the issue can see which third-party keyboard apps they have installed by viewing them in the Settings app and navigating to Keyboard, under General'.

An iOS developer has discovered an extensive list of applications that will be rendered useless for Mac users that choose to upgrade to the Catalina OS when it's released in September.

There are 235 apps included in Steve Moser's list which will affect both individual consumers and UK businesses in particular.

One of the most notable inclusions is popular accountancy software QuickBooks. Users running the 2015 version of the app will have to upgrade to a newer iteration if they also want to make the most of Apple's new operating system (OS).

This particular version of QuickBooks went end of life (EOL) in May 2018 meaning users were locked out of certain features such as online banking and desktop payroll but users can still use it for basic accounting functions.

It may have been discontinued with many users switching to its latest cloud-based version, but those still using the old version will have to upgrade urgently, especially considering the Making Tax Digital penalties for not staying on top of your digital books.

Among other notable affected apps include Adobe Creative Cloud 1.1.0.592 and a vast number of hugely popular antivirus apps including Kaspersky, Norton, Avast, Sophos Antivirus and Sophos Endpoint. Such apps have found use in businesses and by sole traders.

In addition, two apps that stuck out were the popular virtualisation programs Parallels 2.5 and VMware Fusion 3.1.4 - two apps that allow users to run Windows on Mac machines.

IT Pro approached Apple for comment on incompatible apps but it didn't reply at the time of publication.

Apple announced Catalina at its annual Worldwide Developer Conference (WWDC) in June with enhancements to productivity, security and accessibility.

Sidecar is a slick new feature that will allow iPads to be used as second displays for Mac, a feat only possible through third-party apps previously. It will come as good news for video editors, especially considering the UIs of both Final Cut Pro and Adobe Premiere can get cramped even on the biggest MacBook display.

Accessibility gets an upgrade too, Voice Control will allow users to operate the entire OS without touching a single key. Particularly marketed at disabled users, the screen is split up into numbered grids which allow users to tell the computer where to place the cursor, for example.

The iPhone's Screen Time feature which monitors a user's time spent looking at a device will also make its way onto Mac in a bid to tackle the issue of mental and physical wellbeing. Spending too much time in front of Apple's Retina displays and the blue light they, and all other computer displays, emit can lead to poor quality sleep and other compounding issues.

Catalina is available now in Beta to registered Apple developers but is expected to be generally available in September.

If you're wondering if your machine is Catalina-compatible, here are the all the Macs that will be able to upgrade when the time comes:

• MacBook: From 2015 and later
• iMac: From 2012 and later
• MacBook Air: From 2012 and later
• iMac Pro: From 2017 and later
• MacBook Pro: From 2012 and later
• Mac Pro: From 2013 and later
• Mac mini: From 2012 and later

A dozen vulnerabilities including previously undisclosed exploits have been discovered in software used to maintain industrial control systems (ICS) which could lead to another devastating attack on highly-prevalent critical infrastructure.

The researchers from Tenable likened the vulnerabilities to those in the family of devices affected by the infamous Stuxnet attack on an Iranian nuclear facility, adding that the software affected is used across nearly every business vertical.

The vulnerabilities affected four of the most popular ICS vendors: Siemens, Fuji Electric, Schneider Electric, and Rockwell Automation, all of which make some of the most widely used operational technologies in the world.

The researchers notified the vendors of the critical vulnerabilities and have now been patched, but they said remote malicious actors could exploit the software flaws, if left unpatched, to launch targeted attacks, perform administrative functions, unleash malicious code, harvest data or conduct espionage.

Users of the affected systems are urged to check the latest update has been applied, especially now the vulnerabilities have been disclosed.

"The attack scenario cannot be understated as critical systems such as power, water, transportation, and manufacturing all rely on major PLC vendors," said Joseph Bingham, reverse engineer at Tenable. "We will show a theoretical attack using recently discovered vulnerabilities and proof of concept code to disrupt a major power industrial system."

With Siemens' TIA Portal, which was patched this month, attackers could bypass HTTP authentication to gain admin privileges, enabling them to launch malicious firmware updates to modify user permissions or change proxy settings.

The Siemens vulnerability was the most dangerous of the 12 noted by the researchers, but vulnerabilities in the other systems involved remote command execution, memory corruption and stack overflows.

"A simple table with a bunch of exploits to critical vulnerabilities might not feel very impactful to many people... [but] Stuxnet only needed 3 new vulnerabilities to spread through an isolated network and damage centrifuges in the targeted Iranian nuclear facility, said Bingham. "Any of the vulnerabilities listed above could have been discovered by a threat actor and used as a key component in a targeted attack to disrupt or damage industrial hardware."

In a proof of concept exercise run by the researchers in a simulated nuclear reactor, they were able to show how just one exploited vulnerability could lead to major emergency detection systems in a plant being rendered useless, potentially causing a total nuclear meltdown.

"Attacks on critical infrastructure go well-beyond cyberspace -- they have the potential to cause physical damage and harm," said Renaud Deraison, chief technology officer and co-founder, Tenable. "And the threats to these often delicate systems cannot be overstated."

Attackers are exploiting a vulnerability in Cisco switches deployed in data centres across the world to leave politically-motivated messages, according to researchers.

Although the scale of the attack has yet to be determined, Talos, Cisco's cybersecurity arm, has identified more than 168,000 IoT devices with the vulnerability, with analysis by Kaspersky Lab suggesting the attack is mostly targeting the Russian-speaking portion of the internet, impacting entire internet providers and data centres.

A bot is searching for vulnerable Cisco switches via the Internet of Things (IoT) search engine Shodan, according to Kaspersky, and once it finds a vulnerability, can exploit the Cisco Smart Install Client software.

The flaw allows attackers to run arbitrary code on the vulnerable switches, before they are able to rewrite the Cisco IOS image and change the configuration file. Devices then boot up with the message "don't mess with our elections" and an image of the United States flag, before the switch becomes unavailable.

Image credit: Kaspersky

Cisco Talos threat researcher Nick Biasini warned that network administrators need to be especially vigilant, suggesting the simplest way to mitigate these issues is to run the command novstack on the affected device.

He said: "It can be easy to 'set and forget' these devices, as they are typically highly stable and rarely changed. Combine this with the advantages that an attacker has when controlling a network device, and routers and switches become very tempting targets."

Cisco has strongly recommended all customers review their architecture, and use tools provided by Talos to scan their network and remove Cisco Smart Install Client from all devices in instances where it's not being used.

While Talos believes attackers are "associated with nation-state actors", screenshots posted on Twitter by one affected user indicates a group named 'JHT' has claimed responsibility.

Reuters, meanwhile, reported a statement from the Iranian Communication and Information Technology Ministry that says the attack has affected 3,500 switches in Iran.

The Smart Client vulnerability dates back to February of last year, where Cisco first became aware of a significant increase in scans attempting to detect devices where the Smart Install feature remained enabled and without proper security controls, after setup was completed.

Smart Install was initially designed to make life easier for system administrators by allowing remote configuration and OS image management on Cisco switches. By design, these do not require authentication.

Kaspersky Labs suggests it may be a problem of data centres that fail to limit access to the TCP 4786 port, which needs to be open for the Smart Install to work, or to disable Smart Install once it is no longer in use.

Picture credit: Bigstock

Bugs in the underlying firmware of multiple Intel chip families have left laptops, servers and storage appliances vulnerable to a number of security vulnerabilities, the company has admitted.

The silicon giant has confirmed reports from third-party security researchers that flaws in its chips' management and administration functions could potentially allow hackers to execute code, exfiltrate confidential data and more.

Intel launched a full internal review of its source code after it was alerted to the issues, finding that bugs in affected systems could allow attackers to "load and execute arbitrary code outside the visibility of the user and operating system [and] cause a system crash or system instability".

The flaws affect a wide variety of chip families, including 6th, 7th and 8th Generation Intel Core processors, Intel Xeon E3-1200 v5 and v6 processors, Intel Xeon Scalable processors, Intel Xeon W processors, Intel Atom C3000 processors, Apollo Lake Intel Atom E3900 series, Apollo Lake Intel Pentiums, and Celeron N and J series processors.

This covers everything from laptops and 2-in-1s, all the way up to high-end servers and storage appliances. The company has released a free detection tool, which users and sysadmins can run to identify vulnerable machines. IT Pro has contacted Intel to try and determine the number of affected systems.

Three elements of Intel's firmware are vulnerable: the company's Management Engine (ME) Server Platform Services (SPS) and Trusted Execution Engine (TXE). The Management Engine runs underneath the OS, and is used by admins to remotely access a system for maintenance and management tasks. The Server Platform Services feature is based on the ME and offers similar features for server products, while the TXE deals with hardware authentication.

The ME allows anyone with the appropriate credentials to control desktops, make changes to the system's settings and configurations, and even reinstall the OS. This makes it a very useful tool for IT staff at large companies with multiple offices, but it also means it holds a huge amount of power that hackers could take control of.

Because it runs underneath the OS, the ME is invisible to any antivirus systems or hypervisors installed on the machine. Coupled with its highly-privileged status, this means that a compromised ME could be used to install malware, among other troubling things.

A security advisory issued by Intel stated that 80% of the ten CVEs relating to the flaws are designated as high-severity, with buffer overflows and privilege escalations seen throughout.

"Based on the items identified through the comprehensive security review," the advisory read, "an attacker could gain unauthorized access to platform, Intel ME feature, and 3rd party secrets protected by the Intel Management Engine (ME), Intel Server Platform Service (SPS), or Intel Trusted Execution Engine (TXE)."

Intel has confirmed to IT Pro that patches are now available for affected systems, and the company advised that they should be installed as a matter of urgency.

"We worked with equipment manufacturers on firmware and software updates addressing these vulnerabilities," Intel said, "and these updates are available now. Businesses, systems administrators, and system owners using computers or devices that incorporate these Intel products should check with their equipment manufacturers or vendors for updates for their systems, and apply any applicable updates as soon as possible."

Microsoft has started rolling out a fix for the faulty Surface Pro 2 firmware update it was forced to withdraw last month following user complaints about its battery life impact.

The update was released as part of Microsoft's monthly round of Patch Tuesday software patches on 10 December, and was designed to improve system stability and the interaction between the tablet and its keyboard.

Shortly after its release, Surface Pro 2 users began complaining the update was draining their batteries, and would shut down devices when users instructed them to sleep.

Microsoft promptly withdrew the update, and promised users it would come up with a fix after Christmas.

True to its word, the software giant has started rolling out a patch to users affected by the faulty firmware first time around.

In a statement, the company confirmed the move: "This weekend we released an update that addresses the unexpected wake and battery drain behaviour experienced by a small number of Surface Pro 2 customers who installed the December Windows Update.

"This should have no impact on customers who had not received the December update. We are working hard to deliver the rest of the December update to those customers who had not received it prior to it being removed from distribution."

Microsoft has pulled a problematic Surface Pro 2 firmware update after users complained it reduced the battery life of their devices.

The update was released as part of Microsoft's monthly round of Patch Tuesday software patches on 10 December, and was designed to improve system stability and the interaction between the tablet and its keyboard.

However, shortly after its release, Surface Pro 2 users began flooding Microsoft support forums with complaints about the installation problems they had encountered with the update.

Many users said the firmware update failed to load, and did not offer users another opportunity to reinstall it.

Furthermore, some users said the failed update had caused a reduction in the battery life of their machines, and prompted their devices to shut down when instructed to sleep.

In light of this, Microsoft has decided to pull the update.

"To ensure the best experience for our customers during the holiday season, we have taken steps to remove the update for Surface Pro 2 that was previously published through Windows Update on December 10th 2013," Microsoft explained in a statement.

"We are working to release an alternative update package after the holidays," it added.

The statement's closing sentence ruffled a few feathers within the Surface Pro 2 user community, as some assumed the post meant Microsoft's tech team was downing tools over Christmas.

One user, WallyXZ, said: "As it seems like a holiday is so important to you and/or the Surface team, why did you just release such a comprehensive and critical firmware update with a huge impact just before the holidays?

"I suggest that no-one goes home before this critical problem is resolved."

In response, a Microsoft representative assured users in a further forum post the company would be working on a fix for the problem throughout the Christmas break.

"We took the update down to prevent additional customers from ending up in this state. All hardware failures, none of which are known to be caused by the December update, are being handled promptly through our warranty exchange policy," the post read.

A flaw in Trendnet firmware has led to the breach of thousands of IP CCTV camera feeds, exposing people's private lives.

Users' video streams, including those of children's bedrooms, have reportedly been compromised and links pointing to them placed online.

Trendnet said it is rolling out a fix to affected customers.

"Trendnet has recently gained awareness of an IP camera vulnerability common to many Trendnet SecurView cameras," the company said in an official statement.

"It is Trendnet's understanding that video from select Trendnet IP cameras may be accessed online in real time. Upon awareness of the issue, Trendnet initiated immediate actions to correct and publish updated firmware which resolves the vulnerability."

Trendnet SecurView Cameras bought between April 2010 to now may have a firmware vulnerability.

Trendnet is aware that this IP Camera security threat may affect your confidence in Trendnet solutions.

Yesterday, the company said it was working to publish all outstanding firmware within the next 48 hours.

"Trendnet is aware that this IP Camera security threat may affect your confidence in Trendnet solutions. Trendnet extends its deepest apologies to consumers which may be impacted by this issue," the company added.

The company advised concerned customers to email ipcam@trendnet.com if they had any urgent enquiries.

A spokesperson told the BBC the company had not actually issues a formal media release even though it first became aware of the issue on 12 January.

A total of 26 models are affected by the flaw and the company is "scrambling to discover how the code was introduced," the spokesperson added.

Dell has signalled the beginning of a new "virtual era" with the announcement of three storage products at a UK launch today.

The company's vice president of storage, Darren Thomas, claimed server virtualisation is now becoming the norm rather than the exception to the rule in data centres.

However rather than a physical box, the first announcement was the introduction of a firmware 5.0 update for its EqualLogic range. Thomas said this would enable businesses to focus on "intelligent data management", rather than just the mechanics of the creation of virtual servers.

He also said the new firmware would be aware of the presence of virtual machines and of the data load they contained and would automatically create extra space on a storage array without human intervention.

"Automation is crucial, otherwise you can't react fast enough," he said.

The new firmware will also copy data into a new virtual machine up to 72 per cent faster than previously, he claimed, adding: "No one knows how to move data faster than we do".

It would do so with a 95 per cent drop in SAN traffic, and a 75 per cent reduction in CPU usage, he said.

Also introduced were the EqualLogic PS6000XVS and PS6010XVS storage arrays, which enabled the combination of SAS and SSD drives on one enclosure for the first time. Firmware 5.0 would take advantage of this by providing automatic tiering of data from the slower SAS drives to the faster, more expensive SSDs automatically, depending on the demand on the database.

Two new PowerVault storage arrays the MD3200 and MD3200i were also launched, aimed at small to medium businesses. Dell claimed the products provided twice the performance, connectivity and capacity of the previous generation models.

"We've just doubled everything," said Thomas. The arrays can be equipped with up to 96 drives in total and offer same design language as its servers for example the orange handle indicating a hot plug drive in order to ensure they are familiar to existing customers.

Finally, Thomas said Dell was expanding and would offer half day workshops for free to help set up EqualLogic systems, although he claimed it was possible to get an EqualLogic system up and running from the box in under eight minutes.

This was echoed by Gerard Chadwick, the IT director for JMW Solicitors, who said that the ease of setup was one of the factors that led it to choose Dell's EqualLogic storage.

"From a training perspective is very easy to use," said Chadwick. "The eight minutes out of the box setup speaks volumes."

The PowerVault products will both cost 4,333 and be available from 15 June.

The pricing is yet to be confirmed for the EquaLogic boxes but they will be launched in August.

The firmware is available immediately free of charge.

HTC has released a new firmware update for its Google Android-based Hero handset.

The 2.73.405.5 ROM update is now available on its UK website following its roll out across Europe.

The main aim of the update is to speed up the phone's performance, but it also includes a new feature enabling the user to touch the screen to focus on a particular area when taking a photo.

The installation should take about 10 minutes, with the update being downloaded from HTC's website. However, it is only compatible with Microsoft operating systems.

Read our review of the HTC Hero here.

HP has alerted owners of its LaserJet printers of a vulnerability that could lead to unauthorised access of files stored on those printers.

In its security bulletin, HP said 13 different models were affected by the flaw, and said owners should download and apply a firmware patch as soon as possible.

According to a listing on the Common Vulnerabilities and Exposures website, the problem is a "directory traversal vulnerability in the HP JetDirect web administration interface".

Printers are not often thought of as a security risk, but with many now featuring hard disks on which potentially sensitive data could be stored, it makes sense to ensure they are secure.

"Printers tend to be low on the priority list of systems or devices to be patched, this one will likely linger for years to come," said analyst Adrien de Beaupre of the Internet Storm Center.

"The impact might not seem severe, as in the attacker can view the printer configuration, however viewing cached versions of printed documents can be. Other than patching, disallowing access to the web admin interface is likely the only other mitigation."

Research in Motion (RIM), manufacturer of the Blackberry is set to unveil a slew of bugs fixes in its upcoming firmware update for the Blackberry Storm, according to internet reports.

The Blackberry Storm is RIM's first touch-screen handset with an aim to taking on the likes of Apple's iPhone 3G and HTC's Touch HD. However, despite the hype, many users have been reporting issues with the handset, leading RIM to rush release an update to help solve some of the bugs.

According to a leaked internal memo from US network Verizon the bugs to be fixed include:

- If a customer receives a call while listen to music at low volume using a wired headset, the music volume may suddenly increase to the highest level. Interim recovery instructions: Lower the volume using the buttons on the side of the handset.

- When using voice-activated dialing, incoming audio may be muted. Interim recovery instructions: Enter the menu and select "Activate Handset or Speaker".

- The handset may reset itself while sitting idle or while using multimedia applications. No interim recovery instructions provided.

- This update is to be provided over via an over the air update in early December, while the memo also details fixes to be addressed by another maintenance release.

Issues to be resolved by a subsequent Maintenance Release:

- Customers may intermittently lose email connectivity via CDMA and/or international roaming modes. Interim recovery instructions: Main menu -> Manage Connections -> Select mobile network -> Turn radio off, then Turn radio on. If this does not resolve the issue, pull the battery.

- When powering on the handset, the radio sometimes does not turn on. Interim recovery instructions: Main menu -> Manage Connections -> Select mobile network -> Turn radio on. If this does not resolve the issue, pull the battery.

- Pressing the send key while the device is in landscape mode will open the phone application in portrait mode, but the speed dial function may not work. Interim recovery instructions: Press escape until the home screen appears, then press the send key with the handset in portrait orientation.

- Sometimes entering characters on the virtual keyboard doesn't work. Interim recovery instructions: Re-select the character.

Some reports also suggest that the Strom has already been unlocked for use on other networks. Currently it is available exclusively on Verizon the US and Vodafone in the UK.

The recent Apple iPhone firmware update has opened up a massive security hole, with its password protection easily bypassed by just a few taps on the touch screen.

With iPhone 2.0.2 you can access a password protected iPhone by tapping the Emergency Call' keypad from the passcode entry screen. Double-tap the home button and it is possible to get into your favourites.

From here it is possible to call anybody in your favourites list as well as opening up access to the full address book, the dial keypad and voicemail. Tapping the blue arrow next to a contact's name gives you full access to applications such as Mail, Safari, Contacts List, SMS and Maps.

The hole was discovered by users of an Apple news site, and was verified on video here.

The security flaw asks major questions about the iPhone's suitability as a business device. On the Macrumors discussion forum, a user called View' posted: "Sounds like someone at Apple is about to be yelled at or get fired. Nothing is perfect, but this is quite unacceptable."

"It's not a major problem for me since I don't really use that feature, but I'm sure that this shows the unreliability of the iPhone, especially for high-level agents that need to secure their information."

It is possible to prevent a breach from happening by going into Settings, clicking on General and clicking the Home' or iPod' button.

This will mean double clicking the Home button will take you back to the unlock or iPod screen. However, this will mean that you cannot access your favourites if you want to make a quick call.

Reuters has reported that Apple is aware of the problem, and was readying a software update to fix it.