Slashdot Mirror
Hackers Find Remote iPhone Crack
Al writes "Two researchers have found a way to run unauthorized code on an iPhone remotely. This is different than 'jailbreaking,' which requires physical access to the device. Normally applications have to be signed cryptographically by Apple in order to run. But Charles Miller of Independent Security Evaluators and Vincenzo Iozzo from the University of Milan found more than one instance in which Apple failed to prevent unauthorized data from executing. This means that a program can be loaded into memory as a non-executable block of data, after which the attacker can essentially flip a programmatic switch and make the data executable. The trick is significant, say Miller and Iozzo, because it provides a way to do something on a device after making use of a remote exploit. Details will be presented next month at the Black Hat Conference in Las Vegas." The attack was developed on version 2.0 of the iPhone software, and the researchers don't know if it will work when 3.0 is released.
Apple are brown hatters, not black.
BadAnalogyGuy is a scientologist.
Does that mean if we go to the "wrong" web site we can enable Wi-Fi tethering without have to pay extra?
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Isn't it lovely when the text on /. is dumbed down to suit the readers of Doanld Duck ?
I would have thought that "geekdom" ment more than this :p
This signature is DRM protected. By the DMCA, you are not allowed to counteract or oppose to it.
The title and summary are very misleading. The exploit is to run unauthorized code. They have not presented an injection path. While this is not good it is not as bad as having a "Remote iPhone Crack."
To this date, I cannot think of any cell phone viruses that have existed and spread. I would assume that is because pretty much every cell phone is different, and writing a virus for one specific phone would be a waste of time, since it would represent only a fraction of a percent of the user base. (Usually, when you write a virus, you want it to spread as far and wide as possible, right?) However, with the popularity of the iPhone, I could see a malicious person writing a virus that would infect all of the Apple phones out there, since there are a lot of iPhones on the networks.
Could this crack be used for that? If so, are we going to see an antivirus program on the next iteration of the iPhone?
I have a bad feeling about this...
Is there any irony in that some early Apple folks started out phone phreaking?
Well, it's all just chance calculation. Let's say that 1 million iPhones/iPod Touches were sold. Let us then assume that 0.5 percent of the people that buy an iPhone are Evil Haxx0rz and want to hack their new phone. I guess that no more that a half percent of *that* group succeed in finding a way to execute arbitrary code.
One of the 25 is holding his speech at the Black Hat conference in Las Vegas.
TFA makes it sound like there have never been any remotely exploitable vulnerabilities in the iPhone before. There have been dozens of exploitable bugs in Webkit, for example. The fact that no phones were cracked at Pwn2Own didn't prove they weren't crackable.
They went from blue boxes to beige boxes to white boxes. Now the white boxes themselves are getting blue-boxed ;-)
That is, play the right piece of software at 2600 Hz into the iPhone microphone and you can use it to access the whole network instead of Apple and AT&T's walled garden.
Only this time, the wall is on your phone and not the network.
As I recall, Microsoft used to have an api call called PrestocChangeo or some such that did this. Probably in Win16. Always thought that changing a chunk of data into executable code was a bad idea. I would have thought such nonsense was a thing of the past but who knows, maybe that same or similar api still exists. (I'm an old guy and I don't get down to the system level calls much anymore, someone younger will need to look.)
Average Intelligence is a Scary Thing
Comment removed based on user account deletion
Someone correct me if I'm wrong, but doesn't the iphone API specifically prevent 3rd party apps from accessing sensitive areas? For instance non-system apps can't access things like your personal address book. Would those additional controls mitigate the exposure here to the non-sensitive user space?
Don't get me wrong. Any exposure is bad, but the summary makes this sound like some full blown windows remote code execution issue.
Are there any iPhone developers who can chime in with some insight?
Your secular messiah is a failure.
Gitmo still open? Check.
Troops still in Iraq? Check.
Started trade war with Canada? Check.
Pissed off the Brits multiple times? Check.
Outspent Bush in only 4 months, with no end to the spending in sight? Check.
Printed dollars like they were grocery store coupons? Check.
Rewarded union cronies by handing them the carcasses of 2 failed auto companies? Check.
Guaranteeing future oil wars by allowing Iran to build nuclear power plants, but not allowing America to do the same? Check.
Tens of millions of stimulus dollars lost to fraud & abuse, with none of the promised oversight? Check.
Bypassed Congressional oversight of your cabinet by appointing nearly 2 dozen unelected, unaccountable policy "Czars?" Check.
Still spying on Americans' phone calls? Check.
Conducted Great American Apology tour twice? Check.
Failed to take the Muslim world to task for their never-ending egregious human rights abuses? Check.
*This one is my favorite. You somehow managed to create some bizarre moral equivalence between Muslims beating rape victims to death, and Westerners looking down upon Muslim women in the West who voluntarily subjugate themselves to men by wearing a veil. You didn't say it in so many words, but the implied message was there. Such a twisted view could only exist in a sick, twisted liberal mind. The fact is that women and non-believers living in the middle east are subjected to all kinds of horrors in the name of Islam that people would be appalled by here if they actually bothered to pay attention to world news.
Heads up, Obongo: when the summer job market dries up and is no longer able to contribute to your inflated job numbers, and when interest rates reach Jimmy Carter levels, people are going to realize they've been sold a lie. When N. Korea nukes S. Korea and Japan, you're going to be exposed for the impotent milquetoast that you are.
Simply get your application published and give people some incentive to download it (for free). Once your intended target or target quota has installed download a "media file" that's actually the malicious binary. Then it's just a matter of smashing your own application's stack to run the code.
Might this be the dawn of the first "apple virus" that all Mac users claim will never happen? :-)
I know you put the smiley there, but still: who are "all" of these Mac users? I have OS X at home (Unix admin for $WORK), and I partly run OS X because there is currently no malware for it. Just as I prefer Unix for servers as they're a small target as well--in general I avoid Windows whenever I can.
There actually were viruses for Mac OS in the pre-X (10) days, but no one's bothered to really try since the current Unix-based OS came out.
Hopefully Apple will put in measures like ASLR, or SELinux-like protections to help improve 'security' of the OS, but right now you're relatively 'safe'. (The two terms are related, but not the same.)
Perhaps, but this activity is the kind of thing Apple used as reason to not allow users their software freedom with their own phone. Around the time of the iPhone's introduction Steve Jobs told Newsweek:
Leaving one to wonder about that other network called the Internet. Even when viewed only from a security standpoint, this was a tall order to fill. It appears that Apple has failed to fill it.
Digital Citizen
Details of the exploit will be presented next month...
My remote iPhone exploit is a Canadian supermodel.
The Admin and the Engineer
Viruses spread not because a computer can be broken into, but because a computer can be broken into AND because it can broadcast the virus to other computers.
That's why there were no wild Palm OS viruses even when Palm had 80% of the market for years, because the only way to transfer the infection from one Palm to another was for the owner of the infected Palm and the target to deliberately beam a file from one to another.
For cellphones, there's even fewer opportunities for infection, because iPhone owners don't routinely beam files to each other. Most phone-to-phone communication is voice or very short text messages.
What mechanisms are there for an iPhone in my pocket to infect an iPhone in your pocket?
Actually it was a libtiff exploit (open source, but old version) that the iPhone used, not a bug in Safari itself.
[ ] Not told
[ ] Pending
[X] TOLD
LMAO
I love the smell of panicked right wing nut job in the morning, it smells like victory.
Every post brings a smile to my face I love watching you idiots thrash around in impotent fury
making up bizarre and totally false stories to justify your weenie inadequacy.
Great stuff.
I love the smell of panicked right wing nut job in the morning, it smells like victory.
If he were a right-winger, wouldn't he be praising Obama for continuing Bush's bad policies?
-jcr
The only title of honor that a tyrant can grant is "Enemy of the State."