iPhone 3.0 Update Delivers Prodigious Patch Batch

CWmike writes "Apple patched 46 security vulnerabilities in the iPhone and iPod Touch, half of them in the Safari browser and its WebKit rendering engine, as it released iPhone OS 3.0 on Wednesday. One of the patched WebKit vulnerabilities stands out because of the attention it received in March, when a German college student, Nils, walked away with a $5,000 cash prize for hacking Safari at the Pwn2Own challenge. Nils used a bug in WebKit's handling of SVGList objects to crack Safari."

Comments

But the real question is...

[abshack]

Does it support copy & paste?

Re:But the real question is...

[mwvdlee]

$5000... you couldn't hire a security expert to do the same work for that little money.

Re:But the real question is...

[Captain Splendid]

Yep.

Pays to RTFA, eh?

Re:But the real question is...

[dimeglio]

Real iPhone users don't need copy and paste. So the feature is irrelevant.

Re:But the real question is...

[amicusNYCL]

I'm a 30 year old Nude Photographer

Really? People don't have a problem when you show up at their wedding naked?

I am disappointed!

[hansraj]

Frankly I don't know what all the hoopla about iPhone OS 3.0 is about. I was hoping to use compass with google map after the update on my iPhone 3G, but all I got was a lousy voice-memo software.

And before anyone points out that iPhone 3G didn't have compass built into the hardware - It is supposed to be apple! I expect nothing sort of miracles from Steve Jobs!!

On a serious note, tethering was supposed to be there without the need to jailbreak your phone, but it is not available in US, and it is not available in Germany. Could someone tell me where it is available? Phone companies are the scum that are only slightly worse than the music industry.

Re:I am disappointed!

[alannon]

Rogers/Fido in Canada, surprisingly, will allow tethering.

Re:I am disappointed!

[Nixoloco]

If you have AT&T in the US, you can enable tethering and MMS without jailbreaking. It is pretty convoluted process, but it works. This isn't Apple's fault though, but AT&T's.
http://www.krillr.com/blog/3DPQHBZ3/i-have-tethering-and-mms-on-my-iphone-and-yes-im-on-att

Re:I am disappointed!

[thePowerOfGrayskull]

Just be careful - actually doing so and getting caught at it is a violation of your TOS.

Re:I am disappointed!

[Henk Poley]

Go here on your iPhone: http://help.benm.at/

It will show you how to enable tethering.

Re:I am disappointed!

[Xocet_00]

I found this earlier today indicating that Rogers will allow anyone with a 1GB or greater data plan to tether. I called them to confirm and I am in fact allowed to consume bandwidth right up to my 6GB cap, same as if I was consuming the bandwidth on the phone itself.

The really surprising thing is that it's automatic. I didn't have to get them to turn anything on in my account. I simply turned it on in the Network Settings page and was able to tether my Windows 7 laptop and a friends Macbook Pro over both Bluetooth and USB without issues and, even more surprisingly, without iTunes installed (on the Win7 machine).

Bandwidth was around 3Mbps down and 0.3Mbps up, with a minimum ping of around 150ms, tested on multiple servers using Speedtest.net. This is in the middle of Halifax, NS.

Re:I am disappointed!

[dimeglio]

They also allow it on the BB storm.

Re:I am disappointed!

[mdwh2]

Phone companies are the scum that are only slightly worse than the music industry.

Certain companies with certain phones may well be. My phone Just Works on tethering and other things without the need to jailbreak anything :) (I didn't even know it had a special name like "tethering" to be honest - I just thought it was something that worked as standard out of the box with any phone. There's nothing special about my phone, it's just a commonly available cheap bog-standard one.)

Re:I am disappointed!

[sexconker]

What are they going to do? Stop taking your money every month?

Re:I am disappointed!

[jo42]

They'll use it as an excuse to take even more of your money every month. Don't want that now, do we?

Re:I am disappointed!

[vux984]

Have they gotten to the point where they have actually tricked you into thinking there's a difference?

There is a difference. Its subtle, but important. But its not a technical difference it has to do with with service levels, over selling, marketing, and pricing. But that doesn't mean its any less "real.

Essentially, when they give you a 6GB data plan they are overselling their capacity. They know this. I know this. And now you know this. Its not a secret, its not 'teh evil'. If -everyone- used 6GB every month they'd be unable to deliver the service reliably at that price.

Hi end users are subsidized by low end users. Low end users are happy that they have 6GB and don't have to worry about bandwidth everytime they check their email. The carrier has a good idea what the distribution of users is, and knows that it can offer 6gb for $30 bucks, overselling what they can actually deliver at that price, but secure in the knowledge that the mathematical models of their customer's usage patterns virtually gaurantee they won't have to.

But that all assumes no tethering. Its a no brainer to sell 'unlimited data' to a blackberry user a couple product cycles back-- the thing only did email really well, and web browsing poorly. Add in tethering, and suddenly a sizeable chunk of customers on unlimited go from 'low/moderate' usage measured in the kilobytes per day to super-users in the 10s of megabytes per day. Someone that historically only checks his email on his device, getting the odd document, or mp3... well now he now downloading his operating system service pack, virus software update, while watching youtube.

The mathematical model changes. Bottom line: if they allow tethering, consumption goes up sharply for a significant group of consumers. They need to deliver more total bandwidth. That additional capacity costs more to supply and maintain. So they need to charge more for it.

And so we have 'no tethering' in some areas or 'tethering feature' charges in other areas. As as we move forward, the devices become more powerful, and its actually possible to use significant bandwidth on them, but even now, bandwidth usage per unit for untethered use is an order of magnitude lower than what tethered users use.

The carriers fear they would be unable to deliver reliable service at that level at that price point with wide spread tethering. So they're beign cautious about it, and looking to tier the service so that people who need it pay for it.

A final word out to those who despise over-selling and thing the ISP shouldn't do it. Shut the hell up. We, the /. power users, benefit from over selling the most. Its our usage that is subsidized by the low end users. Its because of overselling we can get 6GB for $30 in the first place. If they got rid of overselling the prices we'd pay would shoot sky high, and we'd all pay by the megabyte or some other metering right from the first byte. That would suck.

That's not saying that ISPs are angelic entities looking out for us, but overselling is good business that generally benefits the consumer with lower prices and services offered in a form that we like (I want a 6GB plan more than a plan that charges me 1$ per MB. Over selling and makes efficient use of the available resource...it a case of the free market actually working.

Re:I am disappointed!

[PopeRatzo]

Frankly I don't know what all the hoopla about iPhone OS 3.0 is about.

With the release of 3.0, Apple has once again revolutionized the entire realm of interpersonal communications using technology and have put the rest of the computer industry on notice that things are transformed forever.

Their accomplishment?

Patches.

I'm telling you, the iPhone is the Chuck Norris of high-tech fashion accessories. Everything that Apple does in regards to the iPhone is "revolutionary", "game-changing", and "transformative".

Patches...

Re:I am disappointed!

[venicebeach]

You could be walking backwards.

Re:I am disappointed!

[vux984]

Uh, no.

Uh. Yeah.

You use your phone to access the internet over the cellular network.

Thank you captain obvious.

Whether or not your phone then communicates with your PC or other devices makes no difference. At all.

Actually read my post before you reply. There is no technical difference. But in terms of the business model to support it they are worlds apart.

Take a salad-bar, its the same situation. A single person can't really eat that much food, so I can offer him unlimited food for a fixed price, and make money by pricing it above what the average person will consume.

If people walk in and start expecting to 'tether' and feed their whole family off that one price, that's a game changer. I can't run an unlimited salad bar at that price anymore. The average amount consumed per "plate sold" has gone WAY up.

Similiarly, with a data device, there's really only so much data a single handset will consume. They are still mostly used for email and small files. So you can give people lots of bandwidth for a fixed price above the average cost and make money. If people start tethering, where they suddenly are using a lot more average bandwidth than before, then the pricing is no longer valid. They need to raise the rate, or charge for tethering, or block tethering, or something in response.

Re:I am disappointed!

[vux984]

Download caps and the price per GB we pay far exceed their costs.

for what its worth, cellular networks -- the topic at hand, are a completely different ballgame vs broadband. A few dozen people streaming movies can saturate a cell site that can normally support thousands of voice calls.

Well that's just fantastic

[keeegan]

But when are they going to patch these security flaws on my 2.1 ipod? Paying for an update is ridiculous, especially when it fixes critical security flaws. I sure hope apple does the right thing.

Re:Well that's just fantastic

[Captain Splendid]

Paying for an update is ridiculous

If you feel that strongly about it, go torrent the firmware. Not that hard to do.

I sure hope apple does the right thing.

You must be new here.

Re:Well that's just fantastic

[Hel Toupee]

I have a first generation iPod Touch. It says on the back of the box that software bugfixes are free for life. I'd post a link to google images, but noone's managed to get a picture of the back of the box, go figure.

Re:Well that's just fantastic

[Anonymous Coward]

Go ahead and search Google for the following string, it contains the patches you requested: iPod2,1_3.0_7A341_Restore.ipsw

Re:Well that's just fantastic

[zaajats]

The upgrade to 3.0 is free.

not for iPod touches.

Re:Well that's just fantastic

[tyrione]

You must be a Maddog 20/20 kinda guy.

Re:Well that's just fantastic

[Anonymous Coward]

iPod1,1_3.0_7A341_Restore.ipsw for a first generation

Re:Well that's just fantastic

[zaajats]

Now I'm looking at keeping my Sanza Fuze and Nokia E51. Apple can get fucked.

Your Fuze gets feature-rich updates often?

Point being — I find it somewhat strange that when Apple charges for an update, it's somehow worse than the competitors who don't offer any of the features, free or otherwise.

Re:Well that's just fantastic

[L4t3r4lu5]

My Fuze is a media player, my phone is everything else. I can download apps for it from many Symbian freeware repositories and all I lose is touchscreen and motion sensing.

It was for the convenience of one device, and because it would allow me to drop a mobile tariff for a VoIP application, which I was going to get an iPod Touch, but I disagree with paying for security updates on a fundamental level.

Hacking Safari?

[Itninja]

Maybe I am missing something, but the article linked in the summary (about Pwn2Own's prize for hacking Safari) appears to be about someone hacking IE, not Safari.

Re:Hacking Safari?

[gEvil (beta)]

It helps to move on to page 2 of the article.

Re:Hacking Safari?

[Em Ellel]

Yes, you are missing the part where you should read the article

From TFA:

IE8 wasn't the only browser Nils hacked yesterday. After he took down IE8, he moved on to Apple Inc.'s Safari and Mozilla Corp.'s Firefox, both of which he successfully exploited with attack code he had created earlier. His total for the afternoon: $15,000 in cash from TippingPoint, and the Sony laptop

Re:Hacking Safari?

[slyn]

Every hack in the competition was created early, and it was allowed within the rules to do so.

This made all the sensationalist "MAC CRACKED IN SECONDS" news/blogspam all the more annoying, and the _real_ news all the more painful. The real news was that the Safari exploit that the one dude used to win the Macbook Air had been around since the competition the year prior, and that he chose to save his exploit for the next years competition, and it wasn't fixed before he was able to use it for the CanSecWest 12 months later.

Re:Hacking Safari?

[pv2b]

To give you an idea about how slow Apple are about patching security holes, and to add another data point to the description:

I reported the security issue known as CVE-2009-1697 (which is included in this large patch release). The e-mail back from Apple confirming receiving my report of this issue is dated January 7, 2009 in my e-mail inbox. That's about half a year ago.

Now, granted the security bug I reported is actually very difficult to exploit and do anything actually useful with. Basically, if you used XMLHttpRequests in Safari and requested a URL ending with a newline, it would end up in the final HTTP request as double newlines. I.e. the HTTP header would be terminated prematurely (before the Host: header, significantly) and thereby allow javascript to access files hosted on the default website on the same server the javascript was served from. For example, if victim.example.com is served on the same IP address as evil.example.com - javascript on evil.example.com could use this to request files on victim.example.com.

In other words - you could do cross-site-scripting targetting another web site served on the same IP address as the web site hosting the exploit.

Still, took them about 6 months to patch it and actually roll it out an update, it seems. Heh.

Kiss Pay-As-You-Go "Good-bye"

[ackthpt]

GoPhone subscribers warned the upgrade will be the end of the service.

AT&T Narrows Prepaid Plan Options

"AT&T currently offers two types of prepaid plans: GoPhone, its "pay as you go" plan, and Pick Your Plan, its "prepay once a month" plan. AT&T's statement says that GoPhone will not be available for either original iPhones or iPhone 3Gs; Pick Your Plan will only continue to work for existing subscribers using the original iPhone, as long as they have an unlimited data plan. Current Pick Your Plan users who don't have an unlimited data plan will be asked to add one. iPhone 3G users are not eligible for Pick Your Plan.

According to Erica Sadun at TUAW, who's been investigating this issue, all pay-as-you-go users are being strongly encouraged to sign up for a postpaid plan, which includes making a new two-year commitment."

Looks like I'll be waiting a year for the Apple/AT&T agreement to time-out. I'll not do a two year agreement again, ever.

Re:Apple charges 'by law' - Sarbanes-Oxley act

[mini me]

What I wonder is: How can Apple distribute the Remote application for free? It is an additional feature that was not provided with the original sale. There is no technical difference between downloading Remote through iTunes and downloading iPhone OS 3.0 through iTunes.

I see no problem with Apple charging for the update if they want to charge for it. But the SOX reasoning doesn't seem to make sense when they clearly provide additional features for free already.

Re:Apple charges 'by law' - Sarbanes-Oxley act

[Just Some Guy]

I know... this doesn't change the fact they charge for iPod firmware updates -- and Apple's reasoning is certainly open to well-deserved criticism -- but they lay the blame squarely on the Sarbanes-Oxley act.

That's bullshit. I bought iTouch OS 3.0 for $10 and assure you that it's not a bigger update than any of MS's service packs, or even their own OS X point upgrades. Every OS company - including Apple - somehow manages to give away upgrades, but they're claiming the government made this one illegal? Nope. Apple wanted extra cash and they charged for it, pure and simple. If they'd said something like "we're offering it for free to our premium customers", I think there would've been a lot less anger over it.