When Apple introduced the latest version of its Safari browser two weeks ago, it took the hacking community just hours to start reporting bugs in the beta code. On Friday, the iPhone is likely to get even closer scrutiny from many of the same security researchers. Here's a list of the top items on the typical iPhone hacker's to-do list.

1) Fuzz the Web browser

Apple has made it clear that if you're an independent software developer that wants to write programs for the iPhone, you're going to have to write Web applications rather than software that runs on the iPhone itself. And as the introduction of the Safari 3.0 beta showed last week, Web browser flaws are easy to find.

Security researcher Tom Ferris says he's paid someone to stand in line for him in order to get an early crack at the iPhone. He believes that the iPhone's Safari browser will be similar to the 3.0 beta. And thanks to the iPhone's Wi-Fi support, he expects to be able to run "fuzzing" software that can bombard the iPhone with data over his local network, looking for errors that will cause it to crash.

Ferris says that Safari's support of the Scalable Vector Graphics (SVG) language and the Portable Document Format may provide other avenues for Web attacks. "I'm ready to go," Ferris said. "I've already found some SVG bugs in OS X."

Hackers like Ferris said they discovered nearly 20 bugs in Safari, just hours after the 3.0 release. How many of those will cause the iPhone browser to crash is unclear, but the bigger question is whether or not they will lead to malicious code that the bad guys can actually run on the iPhone.

2) Find a way to debug

Because it wants non-Apple applications to run through the browser, rather than on the iPhone itself, Apple isn't releasing software development tools for its new phone. From a security perspective, this may actually be good news for iPhone users because without any debugging software to tell them what's really going on inside the computer's memory, it will be hard for hackers to develop malicious exploit code to run on the platform. So most iPhone bugs won't do much more than crash the browser.

Though sophisticated hackers could conceivably develop debugging tools for the iPhone it will take more time for real threats to emerge, said Marc Maiffret, chief technology officer with eEye Digital Security. "What you end up having to do is hardware-based debugging which requires physically taking apart the iPhone and using specialized... equipment," he said. "This raises the bar on being able to successfully execute code and hack an iPhone."

The IDG News Service is a Network World affiliate.

Whitepapers

• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users
• IT Departments on Data Security: A Research Concepts Survey

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports