Slashdot Mirror
iPhone Jailbreak Uses a PDF Display Vulnerability
adeelarshad82 writes "Latest reports indicate that the website that 'jailbreaks' iPhones, iPads, and iPod Touches does so by means of a PDF-based vulnerability in OS X. PDF parsing and rendering is a core feature of OS X, and there have been several other vulnerabilities in the past in iOS CoreGraphics PDF components." As Gruber points out, the proper term for this is not "jailbreak," but "remote code exploit in the wild."
I forget can some one remind me what P.D.F. stands for again?
Didn't you know that Apple is more secure?
As soon as I saw "computer-free jailbreak, straight from your browser" I thought "oh man.. here we go."
Apple doesn't get virii like PCs.
GENERATION O98346: The first time you see this, copy it into your sig and remove a random number from the generation. T
Is it really so hard to write a document viewer that can not crash? These aren't small companies. We're talking about Apple, Adobe, Microsoft here. Can't they at least get the core functionality right? I'll settle for safe if getting it right is too much to ask for.
It stands for PeDoFile.
HAND.
So many exploits and spy wares, you'd think more stuff would end up in wikileaks. I guess it all goes to various groups private wikileaks, known as intelligence or something similar..
Build your own energy sources from scratch. http://otherpower.com/
It's really funny to see how this is treated by the mass media. They make it sound like it's a feature...
"Just don't render it that way." - Adobe
Soooo all .pdf exploits instal Cydia? How considerate. I thought only jailbreakers did that.
I love how using Apple products makes everything so easy - Cydia for everyone! Thanks!
Macs (and the iPhone) do not yet have any active viruses in the wild.
It does not mean they cannot get them; there just are none.
This jailbreak thing is indeed a real live exploit running in the wild, but it's a trojan (kind of) since you are asking it to do one thing (display a PDF) and it does another (jailbreak the phone).
In a way it should be labeled Malware, but that hardly seems an appropriate label since it's doing the user a favor...
So there is in fact a known exploit (this PDF bug) and one instance of something that exercises it. Very likely Apple will have this patched in pretty short order - what is really interesting to see is if there will be any "real" (read: malignant) exploits. My guess is probably not, since mobile platforms do not make great zombie systems to control the way desktops do.
If it were a real virus vector the story would be different as the lure of quickly taking over millions of devices would be very strong...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Everyone's so excited about how easy this jailbreak is, the tech blogs are neglecting to report the problems with the current jailbreaks. Homescreen bookmarks no longer work on any iOS 4 devices after applying this patch. This is a known bug that's been in public knowledge for weeks, yet I've seen no tech blogs reporting the problems. Frankly, this jailbreak created more problems then solutions.
PostScript files may not render on certain devices, such as non-PostScript printers.
Any printer can be used as a PostScript printer if the PC connected to it is running an implementation of the PostScript language, which converts a PostScript file to a bitmap image. See GSview.
It's Adobe's revenge!
I came into the office this morning and noticed that a forums thread I monitor on jailbreaking had exploded over my long weekend. I checked the iPhone dev team blog and they explained that there is a new jailbreak that you can visit with the browser on your phone.
I navigated to the page on my phone and it said "swipe here to jailbreak".
I swiped.
It took about 5 minutes to jailbreak my phone and install the Cydia unofficial app store.
Simply amazing work. Once I had Cydia I installed ultrasn0w from the repository and now my phone is carrier unlocked.
Great job, hackers!
Jobs has yet to slay the beast
http://www.thinq.co.uk/2010/8/3/iphone-4-jailbreak-gets-early-update/
It says that it's caused by a PDF vulnerability in iOS, but is it in Apple's PDF viewer or in PDF itself?
Well, there's spam egg sausage and spam, that's not got much spam in it.
Now we just need the jailbreak team to release a Safari/Preview patch to fix the hole. That way, we won't have to go to 4.0.2 in order to be safe from the PDF exploit, thus locking us out from the jailbreak.
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager
Why not? They make great attack drones that are reasonably difficult to trace.
That's true, but system updates can pretty much overwhelm anywhere a rootkit like system would attempt to hide, and users almost always install updates.
The greater willingness of users to actually install automatic system updates is (IMHO) the reason why you really don't see malware or viruses on Macs and iPhones. The whole system shuts down during an update and is pretty easily cleansed.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
That Tavis Ormandy is torn apart for releasing a more complicated vulnerability, but jailbreaking your phone just by clicking a url is widely celebrated. How difficult is it really gonna be to weaponize this jailbreak...
If you consider jailbreaking the iPhone a favor to the user.
The users who are doing it would, that's why they are doing it!
The next site that uses this gaping security hole to install a rootkit, or other malicious piece of software, won't be such a favor. This is a huge security issue for iDevices.
Oh, I totally agree - it's a pretty bad security flaw, and has nice demonstration code for how to exploit it as well so it's pretty much the worst possible case.
That's why it's so interesting to see if there are in fact followup malicious attacks.
The fact that it is a PDF exploit rather than an iOS issue makes it more difficult for Apple to patch since it's not "one of their own".
No. Apple wrote all the PDF handling code in iOS (and on the Mac). We'd see a lot more attacks like this had they embedded Adobe Reader....
Clearly it's Apple responsibility to fix this ASAP (and their fault for letting it get into customer's hands), so they better get on it before someone else starts turning things into iP0wns.
It is 100% on Apple to get a fix out. With 4.1 so close at hand, they may wait on that to finish up... or perhaps it's a sliding scale and the first sign of any real attack will bring down the update hammer if it happens before 4.1 (4.1 beta 3 just came out today and probably fixes this bug).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Cuz ain't no brothas dat can affo'd dis fone.
If you are having trouble with the homescreen, there's a new jailbreak using a youtube video that should work:
http://www.youtube.com/watch?v=Tg4u7ko333U
MacGruber?
Apple does not use Adobe Reader for PDF. I thought everyone knew this by now. Apparently not.
http://support.apple.com/kb/HT4131
Comex basically just diff'd what was fixed in the latest OSX patches against what was in the last iOS patch. Then read up on this patch that hasn't made it to iOS yet. FYI, this won't work if you have 4.1 beta or higher installed supposedly (cuz Apple already had the patch bundled up ready to go when they release the next build)...
The real credit goes to Charlie Miller who found this problem in the first place.
http://www.appleinsider.com/articles/10/08/03/browser_based_ios_jailbreak_utilizes_scary_pdf_security_hole.html
The funny thing I found was that Charlie Miller was given credit by Apple in the patch note.. "Credit to Charlie Miller working with TippingPoint's Zero Day Initiative for reporting this issue." but then Charlie tweets about p[articular exploit.. "Very beautiful work,"... "Scary how it totally defeats Apple's security architecture."
Bad guys can monetize a compromised cellphone in a single step by having it call premium-rate numbers.
Why is this phone not running user mode for this stuff? System mode for services only, why is PDF parsing being handled in system mode? All this stuff, non-executable stacks/data, memory protection etc ought to be set to the max. On the one hand its exciting to see these hacks, on another its depressing since in my own life as an ARM fw programmer, I would have been shown the door 10 yrs ago for that type of coding oversight.
They are not connected to the internet as much
I disagree - they are actually connected way more often than a normal PC. People close laptops, and lots of people shut down desktops at night.
A phone is on 24x7, always connected to the cell network. It's not even shut down for charging.
Also, using a phone as a zombie is going to be draining resources, and phones are built to process as little as possible to save battery.
It would eat into battery quickly to be sure. I totally agree they would be pretty weak for a botnet node.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
There are plenty of other consoles out there that have interesting capabilities.
For instance a Sony Mylo: there are hacks, but none have actually utilised the hack
for running anything yet. ZipIt came out with a hack, and it's doing some neat
things now. There are many little PDA phones that get obsolete just because the
Cell Phone service-network dries-up, but they are still usable if only someone
spent the time to modify them back into a 2-way or non-encryped or half-duplex kind
of tranceiver like back in the day when these were nothing more than glorified portable
HAM radios where namely it's the encryption that can be disable to make them workable again.
But why Apple? They aren't even made in USA like Motorolla once was...
For a good while now the size of drives has been mostly meaningless to me. I don't store any movies or music. My current XP installation, with MS Office and Eclipse, takes up about 10 GB. I'm much more interested in "fast" than I am "big".
This might be useless if the 3G/4G networks gets blasted by a ton of zombied iPhones and updates can't get to the phone so easily.
The updates comes through iTunes on the users home connection, not over the cell network.
Or possibly you could use this to disable the network entirely and essentially brick it until reset to default.
That implies an exponential spread which would mean a real virus. A website or two that spread malicious code would be unable to have this effect. There's really not a good way you could get a virus going on the iPhone, it's not like they are listening to the internet at large for incoming data or have open ports you can do something with.
Besides, on AT&T, how would you be able to tell?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The original jailbreakme.com exploit, the iPhone 1.1.1 one that Woz demo'd on video, cleaned up after itself by patching the graphics bug that it used. Does anyone know if this exploit does the same thing?
Media that can be recorded and distributed can be recorded and distributed.
-kfg
Does anyone know if any sites are auto-jailbreaking phones that visit them yet? If so, what would be the symptoms? I've just released a lite version of Hexius, and went to visit Apptrackr to see if a "cracked" version had appeared yet (yes - lite versions also get cracked for some reason). My phone mysteriously went to the lock screen and the sim had also become locked....
http://www.phasiclabs.com/
Closed game consoles have more inertia to the publishing and distribution process, and it is *extremely* rare for a game to be pulled after it has been on the market for a while...
I know that a lot of the venom towards the walled garden takes the position that it's from the user perspective, but the idea of doing speculative development just to have your app blocked (possibly because Apple may be duplicating the behavior in secret) is certainly a bummer.
Dear mr. Jobs,
You already killed Flash for iOS devices. Now it is time to kill PDF as well.
Kinds regards,
MessageDrivenBean.
Quisque verborum suorum optimus interpres...
The flaw in Apples' software opens the iPhone to the owner in addition to being exploitable by a malcontent (which they should mention and even emphasize, if only in the body of the article.)
What, do you mean by locking down the device an restricting its users in every possible way they can actually turn remote vulnerabilities into good press?
I have to admit it, the marketing gurus at Apple are some real geniuses...
eom
I doubt they care much about the latest gadget having a bug to be brutally frank. Whether you like them or not they tend to deal with somewhat more important issues than Joe Sixpacks iToy getting hacked.
Apple has been the biggest Don't worry attitude type marketing platform...hell this would make me sh*t my pants if I were the CEO of Apple, imagine getting everyone to download an app that is so popular or a webpage hit that is so tremendous that all apple devices are bricked overnight...He would have to replace all of them, and declare bankruptcy!
is code for OTA updates in iPhone
No. As in, the iPhone does not do OTA updates. It's pushed out by iTunes.
You are thinking of Android.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
The question is still valid, then. Is the code that runs on iPhone side during such an update
iTunes does the updates. I don't think you have a very good grasp of what this means. It's overwriting the contents of your phone. There is no code running on the phone during an update. Why should there be? Seems like a massive security risk to run updates on the device itself, when you do not have to.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Technically any form of jail breaking your iPhone is considered by Apple to be a "Vulnerability." All it is, is retaliation against the recent ruling making Jail Breaking Illegal. Your average Joe Schmoe is in essence the vulnerability. The average user doesn't want to watch "how to" videos or read instructions on Jail Breaking, they just want to go to a website and let someone else do it for them. So some crafty programmer, finds this "Opportunity" and ceases it in order to make the process seamless to the end user while having the ability to enjoy the spoils of his conquest, personal information and ad revenue all courtesy of the silly uneducated user. If most users were more internet saavy and had some situational awareness, they would see these dangers and do their research before Jail Breaking, thus making the "vulnerability" a non-issue. Lastly, as soon as people start using Face Time for pr0n or video sexting services, Apple will come out with a statement saying there is a security vulnerability with the camera that allows for pornographic content to be broadcasted from your phone. You may accidently expose yourself to the person on the other end of the video conference...Oh No MR BILL! Mark my words, a staff of "Censors" will be hired and your video chat will have a 7 second delay so they can edit your video on the fly. FML..ooops wrong Forum...
So, when it seems like someone else has control over your phone, it's much more unsettling. You think of it and everything on it as "yours," and every time you're reminded that someone else holds all the keys to it, that illusion is dispelled a little bit more.
Well I'm coming to see it this way. Transparency, public accessibility, open source, GPL, leaks, true information, hacks, jailbreaks, less privacy, and spying, are all are a forms of "uncontrolled data", of data circulating with no control, although with contrary politics and interests depending on when, who, what, and where the data involves. Privacy, security, encryption, proprietary data, closed source, copyrights, patents, successful secrecy, misinformation, are all forms of "controlled data", of some party successfully controlling access according to whatever needs or interests they have. From a political, interests point of view, everyone wants their own data to be controlled, and those of others, to be uncontrolled. From a purely technical point of view, those intests are contradictory. Either we want technology that is controllable, or that is not. Any hack can be be used for spying, or for finding and leaking secret data. A right to privacy and secrecy can be used by a citizen to have the right to go out on a date hidden from his mom, and the same "rights" are used by a corrupt government official to hold private, secret meetings. It's the same tools, just the principles, politics, are different. Mom, or an ex, can spy on the son, or journalists can spy on the official, both violating this privacy. Well, in the end, data tends to circulate too easily, like ideas and thoughts, it seems to be the nature of all three, and going against this nature is just more and more complicated. It's much easier and efficient to go with the uncontrolled-data methods, and have open meetings, date people openly, have open source, less secrecy, and that unfortunately comes with it's price - less privacy. The problem is with the people that abuse this lack of control to data, and use it for secret purposes. Marketing companies, closed source, copyrights, spies, saboteurs, controlling parents, and the jealous ex.
Build your own energy sources from scratch. http://otherpower.com/