iPhone, iPad and iPod Touch have 'critical weaknesses' that could be exploited by criminals, federal agency warns

The software running Apple's iPhones, iPads and the iPod Touch has "critical weaknesses" that could be used by criminals to gain access to confidential data on the devices, Germany's IT security agency has warned.

Clicking on an infected PDF file "is sufficient to infect the mobile device with malware without the user's knowledge" on several versions of Apple's iOS operating system, the Bundesamt für Sicherheit in der Informationstechnik (federal office for information security) said.

Apple says it is working on fixing the security hole. Apple spokeswoman Bethan Lloyd said Thursday the company is "aware of this reported issue and developing a fix that will be available to customers in an upcoming software update." She did not specify when the update would be available.

The problem may occur on iPhone 3GS, iPhone 4, iPad, iPad 2 and the iPod Touch with software versions including iOS 4.3.3, and it "cannot be excluded" that other iOS versions – including the iOS 5 due in September – have the same weakness, said the Bonn-based federal bureau. The warning is published in German on its site .

The problem could occur when opening a website that carries an infected PDF file, possibly allowing criminals to spy on passwords, planners, photos, text messages, emails and even listen in on phone conversations.

"The weak points allow possible attackers to gain administrator rights and get access to the entire system," the bureau said. Apple has not yet issued a fix for the problem. A spokesman for Apple Germany told the Associated Press that it was aware of the warning but would not comment on it.

Apple has sold more than 200 million iPhones, iPads and iPod Touches, of which the vast majority would be vulnerable to exploitation. Mikko Hypponen of the security company F-Secure told the Guardian that if hackers work out how to exploit it, "any web link could redirect to or embed a malicious file".

The weakness was discovered by a team of hackers working on software to "jailbreak" the iPhone so that they can download any software on to it, rather than that approved by Apple. They have also put a fix for the vulnerability on their website, jailbreakme.com – but it requires the user to "jailbreak" their phone in order to load the fix. They have not, however, publicly disclosed precisely how the vulnerability works. That is a barrier to any person seeking to exploit it and means that the risk of its being used remains low for now.

But until Apple works out how to fix the vulnerability and issues a software patch, jailbroken phones are more secure than the huge majority out there.

"If things turn bad and we see an iPhone outbreak via the new PDF vulnerability, there's not much you can do," said Mikko Hypponen of the security company F-Secure. "There are no antiviruses available on the iPhone."

Apple has not yet offered a patch for the vulnerability, known as a "zero-day" weakness because the company has not been informed ahead of time of the weakness. Usually when a security company finds a weakness, it informs the company responsible for the software so there is time to develop a fix before it becomes publicly known.

No attacks taking advantage of it have been reported so far, "but it must be expected that attackers will soon exploit the weak points", the German agency said.

The bureau urges the devices' users to refrain from opening PDF files of unknown origin, whether they be email attachments or those offered on websites.

"Possible scenarios for attacks by cyber criminals include the extraction of confidential information (passwords, online banking data, calendars, emails, SMS or contacts), accessing the device's cameras, the user's GPS data as well as listening in on phone conversations," the statement said.

The bureau reported a similar security hole last year, for which Apple soon presented a software upgrade fixing it.

• This article was amended on 7 July 2011 to include updated information from Apple