Metasploit 3.7 Hacks Apple iOS

An anonymous reader writes "HD Moore is at it again. This time the famous open source security researcher has set his sights on exploiting Apple iOS. The Metasploit 3.7 release includes 35 new attack modules in total."

Comments

It's time

[symbolset]

Now that Apple has garnered hacker interest, let's see how they do.

Re:It's time

[RuiFerreira]

In fact I'm curious about this too. The iphone/itunes link means that you can infect one and get the other as bonus. Additionally phones give more vectors of infection. You carry them around and connect them to several different networks. This has to be appealing for exploiters(tm).

Re:It's time

[mjwx]

Because Apple hasn't attracted any interest in the past few years during its moderate rise in popularity?

There, fixed that for you. Apple's have only gotten out of the 2% of computers in the last 2 or 3 years. Even now they struggle to get 5% worldwide.

Now back onto topic, as a clued in /.er will always point out, malware is a business and business take a long time to react to changes in the marketplace. Malware attacks on phones are new, very new as there was
A) Never a market for phone malware.
B) Phones were never powerful enough to be useful.
C) Too many different types of phones to make any attack worthwhile. Cost would have been way too high to get every single Symbian model out there.

Take note of the last one. IOS drops that cost a lot, making malware on phones economically viable. Further more, IOS has proven itself to be quite vulnerable in the past, you do know that jailbreaking is done by exploiting a vulnerability dont you. Feel free to use the "jailbreak me" PDF vulnerability as an example. The only reason it hasn't been exploited is because there's more profit in Windows malware.

Claiming you are automagically protected when you've never even been attacked is naive at best. It's like Lisa's (Simpson) tiger repelling rock, you cant use the fact that there are no tigers around the rock as proof of it's tiger repelling abilities.

Re:It's time

[CharlyFoxtrot]

Apple's have only gotten out of the 2% of computers in the last 2 or 3 years. Even now they struggle to get 5% worldwide.

This Ars Technica article has Apple at 10% market share in the US, this one has it at 14%. That's a lot of macs. Apple is one of the few companies that have consistently seen their market share grow the last few years in a floundering market.

Then there's Apple's strength in certain niches, like on college campuses :

"According to the Office of Information Technology (OIT), 45 percent of computers purchased this year were Macs, more than in any previous year. In 2003, when this year's seniors arrived on campus, just 15 percent of them chose Macs. The next year, a quarter of incoming freshmen did, and the year after that, 38 percent."

That's a 2006 article and personally I have seen no reversal of that trend, quite the opposite actually. And you'd expect colleges to be hotspots of all kinds of mischief like hacking and exploits.

Take note of the last one. IOS drops that cost a lot, making malware on phones economically viable. Further more, IOS has proven itself to be quite vulnerable in the past, you do know that jailbreaking is done by exploiting a vulnerability dont you. Feel free to use the "jailbreak me" PDF vulnerability as an example. The only reason it hasn't been exploited is because there's more profit in Windows malware.

iOS has had a few exploits and yet we've had only 1 or 2 actual (and amateurish) attacks out in the wild impacting very few people (only jailbreakers with default passwords.) Only twice has there been a remote exploit and both were promptly patched by Apple, the rest have been pretty complicated hacks that require reinstalling the device or putting it in recovery mode. That's a pretty good security record, as good as any device or OS out there.

I don't buy your explanation that it's not economically viable. 120 million of these devices have been sold, mostly to reasonably well off people. That's a huge "market" for exploits.

Claiming you are automagically protected when you've never even been attacked is naive at best. It's like Lisa's (Simpson) tiger repelling rock, you cant use the fact that there are no tigers around the rock as proof of it's tiger repelling abilities.

That's not what I said, no-one claims macs are "magically immune". What I said was that people have been predicting a deluge of viruses and malware for mac for a decade now and it hasn't happened. Sooner or later they might be right, just like the people who say "repent, the end is nigh" might be right someday. In the mean time rehashing old arguments that haven't actually been proven to be true in reality is a waste of time. Reality is the ultimate test of the theory.

Re:It's time

[Anonymous Coward]

This is off-topic, of course, but I want to chime in. I predict that Apple is about to see a meteoric rise in popularity for their desktop operating system. I have been using Ubuntu since Windows 98 stopped getting security updates, July 2006. In my latest computer upgrade, I decided to try OS X because I have found my iPod and iPad so easy to use (and I wanted to run iTunes). I built a hackintosh with the feeling that I could just install Ubuntu if it didn't work out.

I hated it. I couldn't get used to anything - the dock, what happens when you minimize, command-tab and command-`, closing windows not actually quitting the application, and on and on. Then I learned the rule when my wife asked me why Word starts quickly sometimes, but other times it's slow to start: just click. Just click. The computer works it out. If you have too many applications running because you have been closing windows without quitting, don't worry about it. Memory's cheap, and the program text can be removed by the VMM anyway. Just click. Can't find the actual files for your photos now that they've been imported into iPhoto? Why do you care, as long as you can see them, print them, mail them, whatever? Just click. Think it's weird to have a single menu bar that's not even on the application window. Stop thinking - just click.

Now, I love the damned thing. This bloody abomination could really catch on.

Metasploit 3.7 Hacks Apple iOS

[Anonymous Coward]

No, it doesn't.
It just has something to do after you broke in yourself now.

Re:Metasploit 3.7 Hacks Apple iOS

[clang_jangle]

FTFA:

"The post-exploitation modules (post for short) are designed to run on systems that were compromised through another vector, whether its social engineering, a guessed password, or an unpatched vulnerability," HD Moore, Rapid7 chief security officer and Metasploit chief architect told InternetNews.com. "This module requires iTunes to be installed and for a backend to be accessible that has not been encrypted."

Correct. Slashvertisements are annoying enough, at least they should be reasonably accurate. This one falls into the "sensationalist blurb" category.

Re:Metasploit 3.7 Hacks Apple iOS

[silanea]

Maybe /. should introduce a new channel for those news. They could call it "iDle" then.

Re:Metasploit 3.7 Hacks Apple iOS

[pspahn]

I wish I knew what this +5 insightful comment meant.

Re:Metasploit 3.7 Hacks Apple iOS

[pspahn]

It's the "broke in yourself now" part that I'm having trouble parsing.

Re:Metasploit 3.7 Hacks Apple iOS

[tlhIngan]

Darn. I thought there were 35 ways to jailbreak the iPhones these days. Perhaps one of them would work on the iPad2 (which is still lacking a jailbreak).

(Jailbreaking relies on vulnerabilities typically)

Re:Metasploit 3.7 Hacks Apple iOS

[Gilmoure]

Wait, you're telling me hackers have figured out that, if they have a password to a system, they can do stuff on that system? O. M. G. They're gonna be running nuts over all sorts of computers and systems out there.

Sites, Sights

[mikael_j]

"Set his sites"? really?

Re:Sites, Sights

[Anonymous Coward]

Illiteracy != typo

Please stop misusing the word typo; it means typographic error, not a sad ignorance of the language you are using to communicate.

Re:Sites, Sights

[bmo]

Let's eat, Grandpa!
Let's eat Grandpa!

Grammar saves lives.

--
BMO

Re:Sites, Sights

[mdaitc]

If gram-mar (grandma?) were there, she could too!

Re:Sites, Sights

[countertrolling]

Not ignorance... carelessness.. It's happening all over the place now... I find more errors like this on mainstream news sites every day. Professional writers are getting as sloppy as your average Slashdot poster.

Re:Sites, Sights

[pspahn]

If there isn't a red squiggly underneath, nothing is wrong.

Re:Sites, Sights

[cbiltcliffe]

Did you're mom ever tell you knot two luck directly into the son?

FTFY.

Re:Sites, Sights

[cbiltcliffe]

The advent of spelling checker allows semi-retarded people to appear marginally intelligent. Except in cases like these. Without spelling checker, Timothy would be fucking things up every third word.

Really? That reads like one of those Google search results where some bot on a clickthrough search site fits a common search query into the phrase "Find _____ on eBay!"

Find start date of WWI on eBay!
Find natural hair colour Britney Spears on eBay!
Find Microsoft Exchange vulnerability on eBay!

Re:Sites, Sights

[eriqk]

Did your mom ever tell you not to look directly into the son?

She did.
So once when I was six, I did. At first the brightness was overwhelming, but I had seen that before. I kept looking, forcing myself not to blink, and then the brightness began to dissolve. My pupils shrunk to pinholes and everything came into focus and for a moment I understood.

Re:Sites, Sights

[Gilmoure]

It's that big company that screwed over Ripley?

Re:Sites, Sights

[cbiltcliffe]

>luck directly into the son.

You think that "look" and "luck" are homophones? Really?

You're concerned about "look" and "luck", but not "two" and "to"? Really?

That being said, look/luck depends where you're from, and hence, what accent you speak with.

Damn you! DAMN YOU TO HELL!

[RichiH]

Damn you for implying that timothy should proof-read submissions! Heretic!

Not an iOS Exploit In And Of Itself

[rsmith-mac]

The Apple iOS Backup File Extraction module however is not an attack vector for directly exploiting iOS. Rather it is what is known as a post-exploitation module.

"The post-exploitation modules (post for short) are designed to run on systems that were compromised through another vector, whether its social engineering, a guessed password, or an unpatched vulnerability," HD Moore, Rapid7 chief security officer and Metasploit chief architect told InternetNews.com. "This module requires iTunes to be installed and for a backend to be accessible that has not been encrypted."

If I'm reading this right, the "exploit" is that Metasploit can now read unencrypted backups. I'm not sure how this is an exploit (the backup DB format isn't much of a secret), but there you go.

If you want a real exploit, look into the "i0n1c" exploit being used to jailbreak phones on the latest OS.

Re:Not an iOS Exploit In And Of Itself

[joh]

If you want a real exploit, look into the "i0n1c" exploit being used to jailbreak phones on the latest OS.

Exactly. It's not that there are no iOS exploits out in the wild. As far as I know there's no remote exploit out there, though. You need physical access to the device or its backup (and then restore from that which requires physical access).

Re:Enough of this Apple stuff already

[NatasRevol]

*Knowing full well, you're obviously an Apple hater fanboi, and feeding said troll*

The more closed, the better.

Better check your facts. Here's a site that can help.

http://opensource.apple.com/

Go find any other software company that makes it this easy to find *all* their contributions to open source.

Re:'Hack' ? I don't think so....

[WrongSizeGlass]

Since when does the ability to extract an unprotected archive format count as hacking?

Hack, Hackers, Hacking - those words have lost their original meaning (much like Expert has).

HAM?!?

[alex67500]

If I opened my neighbours fridge, I'd start by taking his beers!

Re:Enough of this Apple stuff already

[e4g4]

Also, did you LOOK at that page?

Did you? Click on the links.

Re:Enough of this Apple stuff already

[NatasRevol]

You're a fucking moron who can't even click on links.

Here's whats under the iOS 4.0 link:
JavaScriptCore-576 BSD LGPL
WebCore-737.5 BSD LGPL
cctools-782 APSL GPL
gcc-5664 GPL
gdb-1469 GPL
gnumake-126.2 GPL
keymgr-22 GPL
ld64-97.14 APSL
libiconv-26 LGPL
libstdcxx-39 GPL

Yeah, real Apple specific.