Malicious PDFs exploit iPhone, iPad vulnerabilities

Malformed files that exploit the vulnerability have been publicly posted on the Internet.

Late Wednesday, Germany's Federal Office for Information Security, known by its German-language initials of BSI for "Bundesamt fuer Sicherheit in der Informationstechnik," warned citizens that the iOS bug could be used by criminals to hijack iPhones, iPads and iPod Touches.

"Even clicking a crafted PDF document or surfing to a website with the PDF documents are sufficient to infect the mobile device with malicious software," the BSI said in a translation of the German-language alert .

PDF files that successfully exploit the vulnerability are available on the Web, according to Mikko Hypponen, chief research officer of Helsinki-based antivirus company F-Secure.

And those PDFs could be used by miscreants to hack iOS devices simply by luring users to malicious sites, said Andrew Storms, director of security operations at nCircle Security.

iPhone and iPad users steered to a malicious PDF -- via a link embedded in an email, for instance -- would not receive any warning or be required to take additional action.

"This is a click-and-pwn kind of situation since the user is not prompted to confirm opening the file," said Storms, referring to the term used by researchers to describe hijacking a device.