Slashdot Mirror
Two Unpatched Flaws Show Up In Apple iOS
Trailrunner7 writes "The technique that the Jailbreakme.com Web site is using to bypass the iPhone's security mechanisms and enable users to run unapproved apps on their phones involves exploiting two separate vulnerabilities. One of the vulnerabilities is a memory-corruption flaw that affects the way that Apple's mobile devices, including the iPad and iPod Touch, display PDFs. The second weakness is a problem in the Apple iOS kernel that gives an attacker higher privileges once his code is on a targeted device, enabling him to break out of the iOS sandbox. The combination of the two vulnerabilities — both of which are unpatched at the moment — gives an attacker the ability to run remote code on the device and evade the security protections on the iPhone, iPad or iPod Touch. The technique became public earlier this week when the Jailbreakme.com site began hosting a set of specially crafted PDF files designed to help users jailbreak their Apple devices and load apps other than the ones approved by Apple and offered in its official App Store."
Or feature?
Since its allowed many of us to jailbreak our devices id say its a feature. But one they will want to patch to prevent it. To bad if we don't, we are vulnerable to legitimate attacks.
Now that the feds have officially said we can do this with out any legal repercussions ( well, duh...), why cant Apple just open it up with a disclaimer " yes, here is the unlock code, but if you use it, you void your warranty " then track who uses their code ( a unique key per device ). That way users can have a choice, without relying on bugs.
---- Booth was a patriot ----
More secure does not equal completely secure.
Though you do bring up an interesting point. iOS is the biggest mobile operating system player right now, and even with that large market share, so far nobody has turned all of those iPhones into a botnet. If Windows had the same bug, we would have millions of maliciously compromised systems by now. What gives?
How do you know millions of phones aren't already compromised? They could just be sitting there quietly, waiting for the dust to settle a bit.
Do we need antivirus/antimalware on smart phones now? Welcome to the 21st century.
iOS is the biggest mobile operating system player right now
Yep, it sure is. I mean, if you don't count Android
I remember my old brick of a cell phone back in the 90s. No published exploits yet. Sometimes simpler is better...
"Common sense will be the death of us all"
Um, the fact that jailbreakme.com works is proof that all those things are lining up perfectly. This is a real working exploit.
main(c,r){for(r=32;r;) printf(++c>31?c=!r--,"\n":c<r?" ":~c&r?" `":" #");}
Back when Apple was trying to convince the public to accept this locked down app store model, one of the justifications was malware protection, specifically Jobs himself cited bluetooth worms. But the more these things start to look like and function like a general computer, the most likely attack vector is through websites just like on the desktop. The only other attack vector that Apple stops with this model is the fake screensavers, but apparently they aren't so good at catching unwanted code in the app store either, i believe there was a personal information theft app a few months back and just a few weeks ago there was a covert tethering app.
So i have to ask, if a website can line up a few exploits like this and compromise the entire device to the level needed to actually break the chain of trust Apple has created, what is the point of all this shit? Just so Apple can control their OS environment like a dictator?
BlackBerry? Symbian?
How can I believe you when you tell me what I don't want to hear?
I am not sure why people keep quoting that article when it comes to OS share. Apple sells more iPod touches and iPads than iPhones. Android barely squeaks past just iPhone and only in the US market. I do expect that one day Android will dominate the market, but it has a long way to go.
But...
Two unpatched flaws. What kind of reporting is this? If they were patched there wouldn't be a problem. Do we really need to keep sticking unnecessary and redundant words into a headline? If these flaws have been around for a while you could say "two flaws in IOS remain unpatched" but really, "two unpatched flaws". I'd hate to think what will happen when we find patched flaws.
Calling someone a "hater" only means you can not rationally rebut their argument.
Although various Windows versions may well be less secure than their contemporary Mac versions, Windows was always more vulnerable simply because there was a bigger incentive to attack it (i.e., more users).
Seems that Apple is now paying the price for popularity.
4.1 is probably out very soon now, and I believe it was reported the PDF bug at least is closed (and I assume the other). It's debatable if they should wait even a week for a fix, but as long as there are no malicious exploits in the wild it doesn't matter much to users... I'd bet Apple is sitting on an emergency patch to issue if they had to, but they'd rather just get 4.1 out.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Two unpatched flaws
The really funny thing is, that by adding those words they made the statement wrong - there are patches (PDF for sure), already in 4.1. 4.1 includes a PDF fix for a Mac OS X vulnerability reported on well before this week.
But 4.1 is not yet public (though it should be very soon now).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Yes, it has, it can be tricked into using a rogue cell.
Dilbert RSS feed
Seems that Apple is now paying the price for popularity.
What price? There are as yet no malicious attacks that make use of this attack vector. The only thing that does is using it as a utility that the user invokes on purpose, and even has to swipe to activate it!
Currently Apple users are not paying any price despite having a very popular mobile platform that every now and then has well-publicised vulnerabilities. Hmm.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
iOS is not the biggerst mobile operating system in any way shape or form. RIM has far more devices in North America and Nokia rules the rest of the world.
iOS is the biggest mobile operating system player right now
Yep, it sure is. I mean, if you don't count Android
Count Android all you like, if you count every Android device sold to date it would not equal the number of iPhone and iPod Touch units sold.
The Touch (and iPad) all run the same mobile iOS the phones do.
Note that link was from back in 2009...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Somebody could rewrire the phone lines to my house too, but I don't count that as a vulnerability in the simple electronics in my land line phones.
http://michaelsmith.id.au
But the more these things start to look like and function like a general computer, the most likely attack vector is through websites just like on the desktop
You just made the argument for why users should only use applications vetted from a store instead of the general web.
Happily the iPhone actually doesn't impose any restrictions on web use.
I just thought it was odd you were trying to argue against the security benefits of a closed app store using a bug in a totally open browser model.
The point of the app store would then be that the more applications users used, the less exposed they would be to web bugs. We know attackers inject exploits into popular websites all the time.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Often the patches will not undo already jailbroken systems. So there's that possibility.
But if someone finds they like the jailbreaking, they can just use whatever mechanism will come along to jailbreak 4.1. Usually it's not as dramatic as a browser bug and it involves running an application on your main computer to alter your attached device, but it's easy enough for anyone interested to keep going.
Another option is that jailbreakers can simply replace the 4.0 PDF library with the 4.1 version (if compatible).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
So when android takes over iPhone market. Can we be as smug about volerabilies that come up.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
Apple pretends controlling the app store is enough to prevent malicious code, while this exploit shows that you have to also consider malicious data which injects code via existing "vetted" apps with data handling bugs (since proving app safety during vetting is far from a solved problem). The iPhone continues to become a general purpose computer as long as vetted apps do more and more complex things with data that is obtained from external sources.
I await the audible or visual hack that gets a malicious pattern in through the microphone or camera, and then triggers bugs in the apps that try to do clever things with sound, image, or video!
This just in... Apple bans PDFs on Apple devices... Steve Jobs was quoted as saying "PDFs are yesterday's portable documents - nobody uses them anymore. So we've decided to stop supporting PDFs on Apple devices. In addition, we've decided to not allow any media on our devices that you can't obtain through the iTunes Store. This way nobody can make our devices unstable and insecure like kernel vulnerabilities and overheating chipsets - oh wait..."
I don't know if this scenario is valid, as I don't have an iPhone that can run iOS4. But here goes anyway.
So someone takes their iPhone and jailbreaks it. The two bugs that allowed this are still present in the jailbroken phones so the phones can also be pwned by anyone who comes up with a different exploit that uses these bugs. Clearly the phones can't be updated to 4.1 (as they are jailbroken) so unless someone produces patches independently of Apple they will remain in these jailbroken phones until they are discarded or reset to the official post 4.1 iOS. I wonder how many non-geeks who are persuaded to jailbreak their phones will realize this.
Here's the root of the issue. When someone decides to use an exploitable bug for their own purposes they are not doing any favors for themselves or their users. Exploitable bugs should be reported so they can be fixed, not used to develop your own products - however popular the products might be in some circles. That might well be an unpopular view in this forum, but there it is.
Android and iOS combined don't even come close to Symbian.
Since it's not a modern mobile OS on just about all those phones the point is irrelevant. Like saying there are not as many Android devices as grains of sand on all the beaches in the world.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Considering that tethering and malicious apps have made it through the store is not a safety guarantee.
No-one ever said it was. Security can never be absolute. That's why security is a matter of percentages, and layers... multiple layers work better to protect users. Note this flaw required two exploits to come into alignment, a pretty rare event.
Yes app store reviews can miss things. But App Store apps can be pulled from all devices suddenly with no user involvement (as Google recently had to do). A web site cannot be easily taken down and patching users takes time and willingness on the part of the user to patch.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
That page doesn't say that at all. You've quoted numbers (and even incorrectly inflated the iOS numbers by instead quote the linux desktop numbers) about browser strings. If you scroll down, you will see a VERY different picture of the marketplace for mobile devices (including iPhone, iPad and iPod):
From Gartner:
Symbian: 44.3%
Blackberry: 19.4%
iOS: 15.4%
Windows Mobile: 6.8%
Android: 9.6%
Linux: 3.7%
Other: 0.7%
Even allowing for a hefty margin of error, compared to Symbian, iOS is a very distant third.
Command Syntax of the ultimate computer languge: DoWhatIWant() DoItFaster(Function), eg. DoItFaster(DoWhatIWant()
It still won't work because you are missing a closing parenthesis at the end.
WTF am I doing replying to an AC at 5 A.M on a Friday night?
Because iPhones are lacking in both performance and net access compared to even a low-end Windows machine, so they're mostly useless for botnets.
And you really need a reality check if you think iOS is anywhere *near* the biggest mobile OS.
No problem is insoluble in all conceivable circumstances.
Clearly the phones can't be updated to 4.1
Why not? Jailbreaking doesn't prevent all the normal system stuff from operating as it should, you still sync with iTunes and it would still check for updates. The only downside is that it MAY break the jailbreaking. But even then something like MiFi might well still work.
so unless someone produces patches independently of Apple
Jailbreakers may well do that, they sometimes make modification to system apps as part of the jailbreak.
I've always said that when you jailbreak, at taht point you take a divergent path from Apple's update stream, as you laid out. However in practice, that has not really been true - jailbreak updates almost always follow in a week or two from the official release of a new version of the OS, so you simply update and re-jailbreak - to date Jailbreakers haven't really had to stay diverged from Apple's updates.
After all, the guys who work on jailbreaking get the same pre-release OS all the other developers get, so they have time to formulate new entry points.
Exploitable bugs should be reported so they can be fixed, not used to develop your own products
I agree bugs should be reported and that is the more responsible path, but I don't see anything wrong with making use of the exploits that exist for peaceful purposes.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Everyone here clearly doesn't appreciate the immense effort that Apple has expended to bring people the "real PC user experience" on their phones, just like all the butthurt Android fantards keep whining about. Now you can enjoy "real PC features" like losing 10% of battery life to ineffective but performance-sapping virus scanners!
Who is a bigger player? It is true that Symbian outsells the iPhone more than two to one, but the iPhone is outsold by both the iPod touch and iPad. Some reports claim iOS has twice as many installs compared to the nearest competition.
That we know about.
True, but if we have not heard of any then the infection rate is pretty low - after all you have to get the exploit up on a site and then get the person to visit that with the iPhone browser.
I would argue that most browser use on mobile devices is going to well-known sites (like your favorite news site, bank, etc) so the chances of a rogue website affecting random users seems pretty low.
Given there's working example code showing how to use the exploit you would actually expect something harmful pretty soon, but I've seen no signs of anything. Perhaps anyone who would target it figures since a patch will be out in a few days there's not enough potential gain.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
This article, admittedly using different measurement, says Android is now #1: http://www.boygeniusreport.com/2010/08/04/npd-group-android-top-selling-smartphone-platform-in-u-s-for-q2/ I think it is funny how we can focus on a certain metric to get whatever results we want :)
The Gatner article you are referring to clearly states that those marketshare numbers are for cell phones. The majority of iOS devices are not cell phones at all.
I do have a jailbroken 3g phone. I did try to update and I couldn't. iTunes would let me reset the phone to factory defaults but it wouldn't let me update it.
Did you try resetting the phone, installing the update, jailbreaking again, then restoring from a backup? Usually that migrates in applications and data files. Sort of the same as an update but more roundabout.
Make use of exploits for peaceable purposes? Come on, get back to planet Earth. If you have found the exploits, the bad guys have found them also.
Of course, but just because there are bad uses of the exploits why not write some good ones while the exploits exist? I'm not arguing that Apple should not patch the system, I'm just saying I don't see anything wrong with turning some aspect of a bad situation into a good one.
The only downside is that publishing a positive exploit shows everyone else how to use the same exploit. But then as you say, the bad guys already know about it, probably well ahead of the person writing a positive use for an exploit.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
To use a car analogy, it's more like saying that the number of people that own a Lexus or BMW is dwarfed by the number of people that own a bicycle.
Fixed it for you, and far closer to the case at hand (at least with regards to Symbian).
Your analogy was actually not too bad if we had been talking about Blackberry, except you would have had to add in the fact about roads going forward only being made for Lexux/BMW and Hondas could not use them. How long after you can't use new roads would you be forced to buy some other car, no matter how well it ran?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Those stats are just 1Q2010 sales, which may not be indicative of the total market share of phones currently in use. It's still a much better statistic than the one based on User-Agent strings though. With phones being replaced on average every 2 years though, one quarter worth of sales is an okay indicator, although Blackberry hasn't released too many phones recently.
The ComScore list appears to be better although they don't really say what their methodology is. They don't include Nokia in their list of smartphones and only have stats on US subscribers though...
(May 2010)
RIM 41.7%
Apple 24.4%
Microsoft 13.2%
Google 13.0%
Palm 4.8%
Get your facts straight - Symbian runs on many more handsets than iphone. Its not even a contest, not even close.
I realise it's academic - but why not?
Another way to put it might be: "If it's not completely secure, it's not secure at all".
You are welcome on my lawn.
Apple announced earlier today that they already have a fix and it will roll out soon. It takes about 2 weeks to update half the platform, and another month to get most of the rest.
If you don't consider that a vulnerability, you know nothing about security.
Of course its a vulnerability, just not with the phone. The vulnerability is in the infrastructure.
http://michaelsmith.id.au
iOS is the biggest mobile operating system player right now
bullshit!
Of course it's with your phone:
Your phone should warn you and it doesn't. It's a vulnerability in your phone.
Dilbert RSS feed
It's only racism!
Why bother?
What makes you think the apps are safely sandboxed if the browser isn't?
For one thing, I'm an iPhone developer so I know the exact constraints of the application sandbox.
But also - the browser is sandboxed. Read details of the attack, it breaks the browser but then ALSO uses a second attack to escape the browser sandbox. The question is if the same thing is possible for any application, or if the sandbox exit is unique to Safari.
But having two exploits in alignment is a rare thing. It's rare enough that exploitable bugs in both systems will be hard to come by, and if malware writers are not exploiting the current bug in Safari why would they do so with the much smaller attack space of any one application?
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Will Apple just place the patch in a PDF file on their website, for us all to download and auto-install?
wow, you want to get rid of the browser as well?
You mistook me for the parent; I was noting how he was forming the argument than users should only use app store apps. Me, I don't think the risk of possibly infected web pages warrants closing off the web to any device. I'm all about open standards.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
How about when the camera starts to do face recognition
That I do not think can do anything, because it's a closed system. You collect points about a face and then look them up in a database of known faces. There's really not any way to inject information in there beyond what the system is expecting.
How about voice recognition and commands built into the machine?
Same thing, because the processing of the input attempts to match into a list of known words. Speaking gibberish can do nothing except simply not form a match.
Now both things could be used as triggers for latent code, like an easter egg - say you used face recognition on morgan freeman and got some quote of his. But it would have to be pre-embedded by a developer.
also starts to recognize bar codes and the square patterns
Well that kind of could work, but only by triggering bugs in other systems because those apps just pass through whatever data they read off the QR code or barcode. There's just a limited possibly set of characters that can be encoded so the code can easily handle all input cases. What would work is, for example, embedding a URL to an infected PDF in a QR Code and placing it somewhere obvious in a bar. You wouldn't get many hits but a few people might trigger it, and if you set said QR codes all over... but the user would have to initiate the scan using an application that was built to forward the data.
The smarter you make these things, the more complex they become. At a certain level of complexity, you lose assurance that the security works properly.
You never have any assurance that security works properly, which is why security systems are developed in layers. Adding more complexity does not necessarily increase security risk as long as the complex systems are compartmentalized from each other. Making really awesome face recognition and great voice recognition wouldn't have any impact on overall security since there are no relations between the two, and all they equate to is fancier lookups into internal databases.
Also, most of those systems have to be triggered by the user - it's the passive, always on systems you really need to be concerned about in terms of security risk. The systems you have to activate just sit there inert regardless of complexity or intelligence.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Everyone does realize that the OS of their smartphone has no relation to dick size, right?
What the hell are folks arguing about, anyways? I would figure it's pretty awesome we live in an age where we can decide from multiple choices what advanced operating system will run our phone. That actually gets toward shit I wouldn't have expected growing up.
But I guess folks have been getting pissed about other people's choice of OS for years. I really wish I understood why people get so pissed about that sort of thing. Operating systems are tools, not cults.
That's a mighty big "if" in there... There's no way to know, since root access also means you can completely cover your tracks, leaving no trace that you were even there.
It's not such a big if given the number of people that are on the lookout for active iPhone exploits. Plus you can always notice by outbound communication or by difference in backups. Also it kind of doesn't matter, because anything that managed to install would only be alive until the next iOS update, which would overwrite wherever it might be hiding.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Very well thought out point. Can the world have back the oxygen molecules you are wasting?
very well known that Apple do not like jailbreaking
One of the larger figures in the movement said Apple could stop jailbreaking any time they want to, if they were serious about it.
In fact Apple may say that it's not legal (before it is) but in reality, Apple likes having a small lab where they see what people do with a totally open iPhone - it seems like some of the API's exposed are exposed exactly so you can write apps that could do only do on a jailbroken phone before.
If you really think about it, you can see that any Apple dislike of jailbreaking is a show.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Have you looked at what this does to your iphone in it's entirety?
Me personally? No others have.
But it really doesn't matter because these are the same guys that have been working on jailbreaking since, well, forever. If they were wanting to do something nasty e would have seen evidence by now, only in a Bond movie would someone slave over reverse engineering something for five years only to then turn on the entire user base that was sending them props and lots of money via things like the Cydia app store.
I'm pretty sure none of them have cats or monocles.
Now if it were from some random guy then sure, I'd be pretty suspicious of it. But it's not.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
"No others have." The meaning sure changes a lot when you say "No, others have" as I meant to. People have been reverse engineering the jailbreak.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
All I have to do is to press this button right here, and the '10 best gapes ever' app will simultaneously launch on millions of iPhones. It will be a sweet day indeed.
So include both the iPod touch and iPad, does apple sell roughly 90 million units each year of all their iOS stuff combined? If the answer is no, then they are smaller than Symbian.
You do realise android come on things other than phones.........
For a big name - archos has been knocking out lots of their media players using android for a while now. Theres the dell streak , oh and of course the Chinese ebay android stuff that you just cannot count accurately.
Also - theappleblog.com - nice independent viewpoint.
> iOS is not the biggerst mobile operating system in any way shape or form. RIM has far more devices in North America and Nokia rules the rest of the world.
Mobile phone or mobile device?
Linux by far dominates the world market in embedded systems. But who cares? O/S's are not football teams.
RS.
Ahem... "SIM cards disable that setting" It's more of an issue with the operators....
Ehhhh... did you forget about those other mobile operating systems? Symbian is a lot bigger than iOs. Android has overtaken iOs in the US by quite a large margin. Search $favourite_search_engine for 'android ios OR apple market share' and you'll find a whole lot of opinions, often diametrically opposed, on this subject. Follow the money to see where the truth lies (no pun intended).
Don't believe everything the priest says.
--frank[at]unternet.org
Even allowing for a hefty margin of error, compared to Symbian, iOS is a very distant third.
What's Symbian?
As if Windows havn't had these bugs...
And adnriod is far behind Symbian...
Face it none of them is the largest. Nokia is the largest which even Steve Jobs said in an interview. Nokia just aint American why Americans have little clue of what Nokia is. Nokia started up as a rubber bot maker, then car tires, mobiles phones, monitors and more. Now Nokia has sold of the other focusing on the Mobile Phones.
But yeah Nokia sux compared to iPhone. Also Android is still smaller than iOS, but did sell more last quarter compared to iphone. But that is like comparing Apple trees with Apples. Apples should be compared against Apples. So the iphone should be compared to the HTC's xor Samsung xor SonyEricsson Andrioid phones.
Just as Macs have a global share of 5% which is huge if you compare it correctly against an other computer manufacturer as Dell or HP. But MacOS has a low marketshare when compared correctly against Windows.
Nope Andrioid is still to beat the total marketshare of iOS. But iOS if far from the largest out there.
Ur right but Android has not overtaken iOS yet. But last quarter they did sell more, but that might be because everyone wanting an iPhone was waiting for the iPhone4 just as me.
Android has to repeat lastquarter results a few times before they are larger than iOS.
Maybe true in USA... but USA is small comapared to the "rest", just as the way Americans want to view non Americans.
Symbian is all but dead, blackberry is still in the lead, but is losing ground fast- and this is despite the fact that in the business market the blackberry is pretty much ubiquitous. Android is gaining ground at a tremendous rate.
This was just on slashdot a few days ago:
http://bits.blogs.nytimes.com/2010/08/02/android-passes-iphone-for-new-subscribers/
My 3g phone has horrible, horrible performance with iOS 4. It's slow. Its battery drains faster than normal. The phone runs HOT just browsing the web. Its response time is so poor it's hard to answer incoming calls with the usual swipe.
The upgrade is worse than Vista.
But iOS 4 contains bug and exploit fixes from 3.013.
Increasingly, it looks like I have a phone that works. Or a phone that's secure, since it looks probable that Apple is going to drop support for the 3g since its hardware is so much different than 4's.
Nice one, Apple!
Symbian has the largest market share of them all. How you consider that dead I am not sure.
Because most Symbian phones are marketed under the name of the producing companies (like Samsung or Nokia) and not with the Symbian name most people are under the impression that the company died a long time ago.
It's also not a very popular phone in the US\Canada market since Blackberry and Apple fit as a the market leaders in the smartphone space. Means people in the US rarely hear about it.
The Nokia smartphone OS. Been around since about 1986 in various forms.
Symbian devices are rarely marketed as such and usually just sold as a "smartphone".
Nokia's marketshare globally is flat, and in the US has been declining for a while. The situation is so bad they are looking for a new CEO.
While it is still number 1 - its a very precarious situation as they still haven't launched the N8 - a phone arguably that should have come out 2-3 years ago.
They also lost a lot of customers (like me - and Symbian Guru blogger) over the N97.
Nice random statement. The actions of the company show otherwise.
The actions are that jailbreaking is not specifically blocked by Apple, as it could be.
End of story.
Therefore you are wrong.
Apple's actions show the actually support jailbreaking, as opposed to public bluster.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
In case you get notifications on this stale article... Your entire response shows that you are thinking like a nice, trusting guy. You are thinking about how someone would misuse the features the developer intended to implement. You are ignoring how a blackhat would misuse the bugs the developer never intended.
In face recognition, you don't just attack the faces in the database with lookalikes, you attack the machine-vision algorithm to make it go crazy and generate invalid results, overrun image buffers, etc.
In voice recognition, you could similarly try to break the signal processing code that finds words, in case it doesn't have proper spectral filtering. Although, it could be fun to find ways to obscure voice commands with noise so that the user doesn't hear them but the voice command system does after filtering noise, making the phone do things when the user would least suspect.
Think fuzz-testing. The real devices in the wild can be subjected to crazy patterns never envisioned in the lab. And there are so many devices, that an attack could have low probability of success on each attempt, yet still break many phones just by spamming them with signals in a crowded, public space.
Finally, you say exploits are rare and these double exploits even rarer, while I say here is an existence proof that they are quickly found and attacked. In the last 15 years I have spent considerable time on runtime systems and virtual machine models, and learned that the only constant is new covert channels and leaks. They are not safe.
The fixes for these are going to be in the iOS 4.1?
As root, why wouldn't I be able to mess with the update process?
A very good question.
On the iPhone, updates are handled by iTunes. It basically overwrites the system, and then overlays your user data back on top of it. The iPhone doesn't really get to have a say about what happens to it.
That's one of the reasons why those wanting OTA (over the air) updates might want to think twice, although they are more convenient.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Precisely. When you're root, you can pretty much do as you please.
When you're root, can you stop the user from connecting a cable?
Oops! Guess you should have thought through your answer a bit more and actually read up on the iPhone update process. Read my response to the original poster to see just how off you were.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
My interest is in the secondary exploit.
Me too, that's what really makes everything interesting. An exploit in any one app doesn't matter without a way to break out of the sandbox. I've not found any details on that part though.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I know you're a resident Apple Fanatic, but if I have root access, I can change any bootloader/access file I like.
You have root access to the iPhone. The bootloader is on the computer where iTunes is located... the update process turns the phone off and writes out new data. What exactly are you doing as root again?
The ONLY way to eliminate my root malware is to completely wipe and re-install, as I stated
Which is what it does...
At this point, usually someone who has been such a titanically wrong jackass will admit they were wrong and apologize to save some small shred of dignity. I accept you apology in advance, though frankly I have no need to read whatever kooky excuse you come up with for your misunderstanding in you next post so you're pretty much just setting your own mind at ease.
"There is more worth loving than we have strength to love." - Brian Jay Stanley