Slashdot Mirror

← Back to Stories (view on slashdot.org)

Security Flaw Found That Allows Control of iPhone

Posted by Zonk on from the there's-always-a-catch dept.

i_like_spam writes "The NYTimes is running a story about an iPhone flaw that has been found and documented by researchers from Independent Security Evaluators. Attackers were able to gain full control of the iPhone either through WiFi or by visiting a website with malicious code. The exploit will be demonstrated at BlackHat on Aug. 2nd at 4:45pm. Until then, 'details on the vulnerability, but not a step-by-step guide to hacking the phone, can be found at www.exploitingiphone.com, which the researchers said would be unveiled today.'"

20 of 176 comments (clear)

  1. Excellent! by TheRaven64 · · Score: 5, Funny
    Now users of the iPhone can control their own device!

    Of course, the down side is that so can everyone else...

    --
    I am TheRaven on Soylent News
    1. Re:Excellent! by thedeadswiss · · Score: 5, Funny

      Perhaps they should rename it yourPhone.

    2. Re:Excellent! by Don_dumb · · Score: 5, Funny

      I prefer the iPwn.

      --
      If this were really happening, what would you think?
    3. Re:Excellent! by kai.chan · · Score: 4, Funny

      Or better yet: iPhwn.

  2. Rut roh... by EveryNickIsTaken · · Score: 5, Funny

    Sounds like someone's going to be getting Apple Fanboy death threats tonight....

    1. Re:Rut roh... by Odin's+Raven · · Score: 5, Funny

      Sounds like someone's going to be getting Apple Fanboy death threats tonight....

      I can see the commercials now...

      Mac and PC walk in from opposite sides of the screen. Mac is dressed as a ninja - custom-tailored silks, authentic-looking swords, the works. PC wears his typical clothes, but in a disheveled fashion reminiscent of Michael Douglas in "Falling Down", complete with briefcase in one hand and machine gun in the other. (Although it's painfully obvious that PC's "gun" is a cheesy plastic model acquired from the local toy store.)

      • Mac: Hi, I'm a Mac Fanboy death threat.
      • PC: And I'm a PC Fanboy death threat.
      • Mac: The other day someone claimed an Apple product was less than perfect.
      • PC: Every day people say I'm no good. Every...damn...day.
      • Mac: I hear ya, PC. In my case, I've assembled a multimedia production based around video clips taken while discretely stalking the person responsible, as text seamlessly scrolls past detailing the inherent superiority of the product in question and Mozart's "Dies Irae" from his "Requiem in D minor" plays in the background. (Pulls out iPhone and shows to PC - we catch glimpses of the movie and hear a snippet of music.)
      • PC: I have a powerpoint slide I send the offending party. (Opens briefcase and pulls out a tattered piece of paper, hands to Mac).
      • Mac: (Reading paper) Hmmmm, "U r a lozer and yu is teh suckz. Im gona hurtz u 4 ur makking fun of me. Micrsfort rulez!" Yes, that should certainly make an impression. Nice use of the WingDings font for the dagger.
      • PC: Thank you. Some people think I'm limited to boring text, but I do have access to some pretty snazzy graphics.
      • Mac: Yes, I've never seen anything quite like it. Oh well, I'm off to infiltrate the home of the person who offended me, silently scaling the outside wall, entering through an open skylight, and performing a triple-backflip as I drop to the floor, where I'll leave my threat nestled in a bouquet of lotus flowers.
      • PC: (Rolls eyes, clearly unimpressed.) Whatever. I'm going to catch the midtown bus, and nail my threat to the person's front door. And if they give me any lip, I've got this!
      • (PC brandishes toy gun, pulls trigger. Gun plays a few seconds of 80s-era laser sounds, which trail off as the batteries die.)
      • PC: Darn, why does this always happen? Now I've got to get a new weapon.
      • Mac: Do you want to call a few places, see what's in stock? (Offers iPhone to PC)
      • PC: Thanks, I ... (starts to reach for iPhone, changes mind.) Ummm, no, actually I'm good. Everything's just fine. Okay, gotta go.
      • (PC shuffles dejectedly offscreen. Mac watches PC leave, then does a backflip out of frame.)
      --
      A marriage is always made up of two people who are prepared to swear that only the other one snores.
  3. The technical paper is the article by nmoog · · Score: 4, Informative

    Have a read of the technical paper from the article - Quite interesting. They used fuzzing to find a heap overflow vulnerability. They go on to talk of "Blackbox Exploitation", which I later realise has nothing to do with the cinematic genre.

    1. Re:The technical paper is the article by iluvcapra · · Score: 4, Interesting

      Most interesting pieces of information from the article:

      Additionally, no address randomization was used in by the operating system.

      the filesystem accessible to iTunes is chroot'ed such that only a small set of the filesystem is visible over this [USB] connection.

      it is possible to modify the iPhone in such a way that the applications will dump core files when they crash. This is accomplished by adding the file /etc/lauchd.conf containing the line limit core unlimited to the iPhone using iPhoneInterface. Core files can be retrieved off the iPhone from the /cores directory, again using iPhoneInterface.

      Under their suggestions:

      Install applications such that they run as an unprivileged user. This would result in a successful attacker only gaining the rights of this unprivileged user.

      I don't see how that'd help on a single-user computer., tho (another of their suggestions) chrooting all the running apps would be a step in the right direction. The researchers are politicians, too:

      This limited access to the filesystem doesn't particu- larly serve a security role from the perspec- tive of a remote attacker. Instead, this serves as an example of design intended to protect the exclusivity of the iPhone to AT&T. If more thought had gone into protecting the applica- tions from remote attack and less on prevent- ing the unlocking of the device, the overall security of the device might have improved.

      Translation: Running iTunes in a chroot jail makes the iPhone insecure, because my unicorn says anything done for the sake of AT&T is insecure.

      --
      Don't blame me, I voted for Baltar.
  4. Dear Author of Malicious Code by chuckymonkey · · Score: 4, Funny

    As a loyal Mac user and iPhone user I have to kill you.

    Signed,
    Mac Zealot

    My life for Aiur!....errr Steve Jobs!

    --
    "Some books contain the machinery required to create and sustain universes."-Tycho
  5. Update Deployment by da_matta · · Score: 4, Interesting

    It's interesting to see what the response to this will be and how long it will take to for Apple to to release and deploy a patch. Mobile phones don't typically the "fast background patching"-systems like PC's (mobile data typically costs so you can't keep checking for updates). And everyone remembers from "pre sp2"-XP what it means if it's up to the user to check and deploy patches (e.g. iTunes).

    1. Re:Update Deployment by jrumney · · Score: 5, Informative

      iPhone patches will be delivered automatically through iTunes, the same way iPod ones are. So while you won't get them OTA, it is still better than most cellphones which require you to go out and find patch installers, and in some cases these can only be obtained from official servicing agents, not over the web.

  6. The Difference is Responsibility... by iMouse · · Score: 5, Interesting

    Apple iPhone users should be content with the finding of an exploit by responsible security researchers. Unlike InfoSec Sellout (who is likely blowing smoke up his as*), Charles Miller and the rest of the Independent Security Evaluators team should be applauded for their work. They responsibly reported the vulnerability (and a potential fix) to Apple for investigation.

    The Apple community should not in any way, shape or form, harass this group like they harassed InfoSec Sellout. I.S.E. are the good guys and as a 15-year Apple veteran, I give my best to those who are out to help Apple keep security at its tightest on their products and services.

  7. Neat - the interesting thing will be the response by jht · · Score: 4, Interesting

    Now let's see how long until the first iPhone patch comes out, and if any of the other glitches will be fixed at the same time or if it's strictly for security. Obviously Apple's already been working on iPhone patch #1 and is probably just about ready to push it out after a month.

    One functionality change that _should_ come out of this, though - I would turn off the default behavior of scanning for open networks and asking to join them. It wastes battery power, and the pop-ups for new networks are intrusive. In its place I'd put the AirPort icon in the display full-time (instead of just replacing the EDGE "E" when you are on a WiFi network) and allow quick access from there. I think, altogether, iPhone will be a pretty secure device after the initial flushing out of bugs, but this is a little different from traditional devices. iPhone has a classic desktop OS stripped down into a cellphone, whereas mainstream other devices (Palm, Windows CE, and Symbian) were designed more as cellphone systems (or PDA systems) and scaled up.

    (not replacing my iPhone with a Razr anytime soon!)

    --
    -- Josh Turiel
    "2. Do not eat iPod Shuffle."
  8. Re:Stop waving that damn thing around by riffzifnab · · Score: 5, Funny

    Should we be getting off your lawn now or is it almost time for your nap? d:

  9. Re:no wonder they don't allow programming the thin by brilwing · · Score: 4, Interesting

    I don't know the newer Symbian versions 8 and 9, but till version 7 there was no security in Symbian at all. Every program could do everything. I have programmed an installation program that opened a GPRS connection, downloaded a SIS file and installed it on the Symbian phone without user interaction!!!
    This was a bit tricky but it worked fine on Nokia Series 60 phones an on Sony Ericsson P800 and P900.

    I don't think that Symbian managed it in version 8 and 9 to build in a ground up security, because the SDK is huge with thousands of classes.

  10. Duke WAS NOT Apple's fault by LKM · · Score: 4, Informative

    Yeah, I can see how you're confused, because all the news outlets reporting about how the iPhone destroyed Duke's network did not bother to report that it was all made-up crap.

    Last week:

    "I don't believe it's a Cisco problem in any way, shape or form."

    This week:

    Cisco worked closely with Duke and Apple to identify the source of this problem, which was caused by a Cisco-based network issue. Cisco has provided a fix that has been applied to Duke's network and there have been no recurrences of the problem since.

    Maybe at least /. could bother to retract the story?

    Nah, who cares, it's just your usualy weekly Apple bashing.

    1. Re:Duke WAS NOT Apple's fault by jeffasselin · · Score: 4, Informative

      You mean like posting an updated story?

      http://hardware.slashdot.org/article.pl?sid=07/07/ 21/1212217

      --
      If he explores all forms and substances Straight homeward to their symbol-essences; He shall not die.
  11. iPhone owner is not surprised by goodmanj · · Score: 4, Informative
    From TFA:

    [Fuzzing] involves sending malformed data to the device in an effort to cause a fault and make it crash. The vulnerability we discovered and exploited was found in MobileSafari using fuzzing. Since MobileSafari crashes every ten minutes or so for me with *well*-formed data, I'm not surprised to hear that this is possible. Apple *seriously* needs to push out a Safari bugfix asap, not just for security, but for usability.
  12. An iPatch? by Anonymous Coward · · Score: 5, Funny

    If Apple releases an iPatch, does that mean they support piracy? Arrrrrr, avast ye LAN-lubbers!

  13. Re:no wonder they don't allow programming the thin by PolarIced · · Score: 5, Funny

    Here are some more examples of Symbian security (apparently their first priority):

    1. The phone randomly locks up and/or turns off - this fools 3v1L hackers.
    2. Won't connect to most Bluetooth devices - keeps hackers out. Very clever!
    3. When syncing contacts, it mixes up all the fields so that an 3l33t hacker won't be able to make sense of them. You won't either, but at least you're safe.
    4. Apparently has a built-in function to slow all operations to a C...R...A...W...L... - this prevents hackers from using high speed automated systems to hack your phone. Ingeneous!

    Signed,
    A proud owner of a Cingular Nokia (Swedish for moose dung) phone.

    PS - Hack my phone. I dare you! Whoops . . . wait a minute. Let me reset it first.