Slashdot Mirror
Hackers Find Remote iPhone Crack
Al writes "Two researchers have found a way to run unauthorized code on an iPhone remotely. This is different than 'jailbreaking,' which requires physical access to the device. Normally applications have to be signed cryptographically by Apple in order to run. But Charles Miller of Independent Security Evaluators and Vincenzo Iozzo from the University of Milan found more than one instance in which Apple failed to prevent unauthorized data from executing. This means that a program can be loaded into memory as a non-executable block of data, after which the attacker can essentially flip a programmatic switch and make the data executable. The trick is significant, say Miller and Iozzo, because it provides a way to do something on a device after making use of a remote exploit. Details will be presented next month at the Black Hat Conference in Las Vegas." The attack was developed on version 2.0 of the iPhone software, and the researchers don't know if it will work when 3.0 is released.
Apple are brown hatters, not black.
Does that mean if we go to the "wrong" web site we can enable Wi-Fi tethering without have to pay extra?
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
The title and summary are very misleading. The exploit is to run unauthorized code. They have not presented an injection path. While this is not good it is not as bad as having a "Remote iPhone Crack."
Well half of the geeks have below average intelligence. Just because you think tech stuff and science is neat it doesn't mean you are any smarter then the rest of the population.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
To this date, I cannot think of any cell phone viruses that have existed and spread. I would assume that is because pretty much every cell phone is different, and writing a virus for one specific phone would be a waste of time, since it would represent only a fraction of a percent of the user base. (Usually, when you write a virus, you want it to spread as far and wide as possible, right?) However, with the popularity of the iPhone, I could see a malicious person writing a virus that would infect all of the Apple phones out there, since there are a lot of iPhones on the networks.
Could this crack be used for that? If so, are we going to see an antivirus program on the next iteration of the iPhone?
I have a bad feeling about this...
You're assuming that geeks have equally distributed intelligence (no, not a Beowulf cluster). That's like saying half of Nobel Prize Winners have below average intelligence because "you think tech stuff and science is neat it doesn't mean you are any smarter then the rest of the population."
FTFY:
Half of the geeks have inteligence below the median inteligence of the geek population.
Is there any irony in that some early Apple folks started out phone phreaking?
Well, it's all just chance calculation. Let's say that 1 million iPhones/iPod Touches were sold. Let us then assume that 0.5 percent of the people that buy an iPhone are Evil Haxx0rz and want to hack their new phone. I guess that no more that a half percent of *that* group succeed in finding a way to execute arbitrary code.
One of the 25 is holding his speech at the Black Hat conference in Las Vegas.
Half of the geeks have inteligence below the median inteligence of the geek population.
Sadly, the distribution of spelling ability is not so evenly spread among the geek population...
Forget thrust, drag, lift and weight. Airplanes fly because of money.
TFA makes it sound like there have never been any remotely exploitable vulnerabilities in the iPhone before. There have been dozens of exploitable bugs in Webkit, for example. The fact that no phones were cracked at Pwn2Own didn't prove they weren't crackable.
My experience with dealing with geeks seem to show me that the distribution of intelligence is about on par with the rest of the population, in its normal distribution. We like to see our selfs better then everyone else but that really isn't the case.
I have found that people who are on the manufacturing floor of a factory are just as likely to pick up an abstract explanation as a geek would. Sure geeks have memorized some terms and vocabulary however for the most part their ability to understand is about the same as everyone else.
Conversely there are a lot of people who know things that it is difficult for me to comprehend who are not geeks about the same amount who are geeks.
You analogy is off. Because geeks are a sub-culture Nobel Prise Winners are people who won an award for their excellence.
What does it take to be a geek. Watch a lot of Star Trek, or Sci-Fi, Read Comic Books, Write code (I was able to do then when I was 6 years old) none of this requires a high intelligence, to preform at some level.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
They went from blue boxes to beige boxes to white boxes. Now the white boxes themselves are getting blue-boxed ;-)
That is, play the right piece of software at 2600 Hz into the iPhone microphone and you can use it to access the whole network instead of Apple and AT&T's walled garden.
Only this time, the wall is on your phone and not the network.
As I recall, Microsoft used to have an api call called PrestocChangeo or some such that did this. Probably in Win16. Always thought that changing a chunk of data into executable code was a bad idea. I would have thought such nonsense was a thing of the past but who knows, maybe that same or similar api still exists. (I'm an old guy and I don't get down to the system level calls much anymore, someone younger will need to look.)
Average Intelligence is a Scary Thing
yehe, dem sai dat eyem sisks standird dieaveations twu da leaft
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Comment removed based on user account deletion
Someone correct me if I'm wrong, but doesn't the iphone API specifically prevent 3rd party apps from accessing sensitive areas? For instance non-system apps can't access things like your personal address book. Would those additional controls mitigate the exposure here to the non-sensitive user space?
Don't get me wrong. Any exposure is bad, but the summary makes this sound like some full blown windows remote code execution issue.
Are there any iPhone developers who can chime in with some insight?
Simply get your application published and give people some incentive to download it (for free). Once your intended target or target quota has installed download a "media file" that's actually the malicious binary. Then it's just a matter of smashing your own application's stack to run the code.
Might this be the dawn of the first "apple virus" that all Mac users claim will never happen? :-)
I know you put the smiley there, but still: who are "all" of these Mac users? I have OS X at home (Unix admin for $WORK), and I partly run OS X because there is currently no malware for it. Just as I prefer Unix for servers as they're a small target as well--in general I avoid Windows whenever I can.
There actually were viruses for Mac OS in the pre-X (10) days, but no one's bothered to really try since the current Unix-based OS came out.
Hopefully Apple will put in measures like ASLR, or SELinux-like protections to help improve 'security' of the OS, but right now you're relatively 'safe'. (The two terms are related, but not the same.)
Perhaps, but this activity is the kind of thing Apple used as reason to not allow users their software freedom with their own phone. Around the time of the iPhone's introduction Steve Jobs told Newsweek:
Leaving one to wonder about that other network called the Internet. Even when viewed only from a security standpoint, this was a tall order to fill. It appears that Apple has failed to fill it.
Digital Citizen
Details of the exploit will be presented next month...
My remote iPhone exploit is a Canadian supermodel.
The Admin and the Engineer
Is he really? I'd like to see some evidence and form my own conclusion.
maybe a little off topic, but spot on.
He's saying that geeks are a random sample of the population with regard to intelligence, yes. If you've ever heard an MSCE call himself a geek, you'd agree.
Very well said...that's one of the self-delusions of many in the geek community that really irritates me (that we're smarter ergo better than everyone else). It seems a lot of this goes along with the rise of geek chic.
In highschool and the like, I always felt sorriest for the dumb geeks / dumb nerds...they had it worst of all IMHO. And yes I agree, there are absolutely dumb geeks
Viruses spread not because a computer can be broken into, but because a computer can be broken into AND because it can broadcast the virus to other computers.
That's why there were no wild Palm OS viruses even when Palm had 80% of the market for years, because the only way to transfer the infection from one Palm to another was for the owner of the infected Palm and the target to deliberately beam a file from one to another.
For cellphones, there's even fewer opportunities for infection, because iPhone owners don't routinely beam files to each other. Most phone-to-phone communication is voice or very short text messages.
What mechanisms are there for an iPhone in my pocket to infect an iPhone in your pocket?
oh here we go again. maybe they got an MCSE because they had a hard time getting a job. what you know you can do in your own life is hard to convince a HR manager of on a resume. the MCSE just lets them fill that checkbox. lay off the hate.
Actually it was a libtiff exploit (open source, but old version) that the iPhone used, not a bug in Safari itself.
I have found that people who are on the manufacturing floor of a factory are just as likely to pick up an abstract explanation as a geek would.
So being a geek is more a function of nerd literacy rather than intelligence? I concur. I would also expand this to personal hygiene (specifically lack thereof) as well.
by Mike Buddha -- Someday the mountain might get him, but the law never will.
Very well said...that's one of the self-delusions of many in the geek community that really irritates me (that we're smarter ergo better than everyone else). It seems a lot of this goes along with the rise of geek chic.
But isn't the point of choosing to be in any social group an effort to feel better about oneself? Some geeks take the easy way out by making themselves feel taller by shoving people beneath them.
by Mike Buddha -- Someday the mountain might get him, but the law never will.
But isn't the point of choosing to be in any social group an effort to feel better about oneself? Some geeks take the easy way out by making themselves feel taller by shoving people beneath them.
Yeah, I absolutely agree.
I have a very vivid memory of being in 7th grade science class and snickering at this kid who could barely read. At the time it was annoying, funny, and felt like a waste of my time to be in this class (which it probably was) ...and my friends and I snickered. I've felt guilty about that for a long time...one of my "wake up" moments in life.
[ ] Not told
[ ] Pending
[X] TOLD
Maybe this is an attempt at a new form of Six-Sigma compliance?
I prefer postforming to 'preforming' when I perform, I also want a 'prize' for for all the geeks who don't fall over 'ourselves' to point out other people's shortfalls.
Sorry, couldn't help it...
Thank you for using 'ergo' -- and correctly! It's a highly underused but useful word. Kudos.
It seems a lot of this goes along with the rise of geek chic.
When did this happen and why wasn't I informed?
All intents and purposes. Not intensive purposes.
LMAO
I love the smell of panicked right wing nut job in the morning, it smells like victory.
Every post brings a smile to my face I love watching you idiots thrash around in impotent fury
making up bizarre and totally false stories to justify your weenie inadequacy.
Great stuff.
I love the smell of panicked right wing nut job in the morning, it smells like victory.
If he were a right-winger, wouldn't he be praising Obama for continuing Bush's bad policies?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
when interest rates reach Jimmy Carter levels
What makes you think that the Fed is suddenly going to give up their inflation policy?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."
Don't be too hard on yourself. Children are self-centered, then we grow out of it.
by Mike Buddha -- Someday the mountain might get him, but the law never will.
(from Merriam-Webster)
1 : a carnival performer often billed as a wild man whose act usually includes biting the head off a live chicken or snake.
2 : a person often of an intellectual bent who is disliked
3 : an enthusiast or expert especially in a technological field or activity
Unless you're talking about #1, a group with an above average percentage of intellectuals and experts is going to be above the average in intelligence. May I suggest that the people you've met are not necessarily representative of all geeks. I would also venture to guess that it's not so simple to estimate someone's intelligence from casual interaction. You're really taking a lot on faith. There's also the possibility that the average non-geek is a lot dumber than you realize.
I take it you don't self-identify as a geek, or you see yourself as much smarter than other geeks. Either way, I've seen that before.
So being a geek is more a function of nerd literacy rather than intelligence? I concur. I would also expand this to personal hygiene (specifically lack thereof) as well.
Great. So, we can claim all the negative stereotypes about us without objections, but despite being a group that reveres intelligence and aspires to academic achievement, we're probably a lot dumber than people think.
No, it's worse than that. According to you guys, we're dumber than the average, which is ridiculous. Could it be that you are overstating your feelings?