Slashdot Mirror
Guide To Building a Cable That Improves iOS Exploits
mask.of.sanity writes "An Aussie network engineer has published a guide to building a serial cable connector that allows access to a secret kernel debugger hidden within Apple iOS. The debugger was a dormant iOS feature carried over from Apple OS, and seems to serves no function other than to allow hackers to build better exploits. The cable needs an external power source and a jailbroken device to access the debugger." We've mentioned Pollock's serial adapter kit before, modulo the kernel debugging abilities.
If consumer access was unintended but a way to get to it was found, I would call it an exploit either way.
Wait... so in order to use the cable to find exploits, you need a jailbroken device. But in order to jailbreak your device, you need to first find an exploit.
* Yes, I do know that there are other ways to find exploits...
it it was an exploit that was taken care of them it would be a exploit now so it wasn't taken care of to start with so they are to blame.
wouldn't be an exploit now. this site needs the option to edit your posts
I remember the days when apple play commercials claiming their OS don't get virus's, malware, etc. Now we see these story's weekly proving that all the load of bull apple claimed about their OS was nothing more them a lot of S
It's amazing that Apple and Jobs in it are so shortsighted that they don't provide official tools that people want. Of-course they have contracts with AT&T and who knows what else, that's most likely why they don't want to let people use these devices as general purpose computers, so that normal apps could be executed (and then you can use Skype or whatever to go around long distance phone charges obviously). But still, this is just so screwed up that a company would not see that it is in its best interest to sell the phone with the maximum possible features in it. OK, have an official Apple utility to so called "jail break" the thing and enter another lucrative market of various adapters and gadgets that could be then used together with the phone.
These devices are general purpose computers with wireless access and an odd phone application installed on them. Let the people use them the way they want to.
Of-course the unwillingness of Apple to allow people to use their own freaking product the way they want to provides HUGE market for all the other types of phones (Android) to fill that gap. It's just the short-sightedness of Apple is amazing in this instance.
You can't handle the truth.
Where did you read exploit? It says that the kernel debugger can serve as a tool for exploiters.
Leave your stupid fanboyism at the door next time, please...
Here be signatures
Steps are :
# circumvent Apple security features* (aka jailbreak) your iPhone using currently known security holes and gain root level access
# uses this tool to find new security holes and keep silent about them, hoping neither Apple nor hackers with malicious intend find them too
# when Apple plugs already found security holes, hope it didn't plug the ones you just found so you can repeat step 1 on the newly released (hopefully) more secure firmware
PS : I know that the App stores ALSO introduces censorship but for MOST users and applications, it first and foremost blocks buggy/malicious/infringing applications (this is such a troll bait that I preferred to be an anonymous coward).
Forget IOS and consider the after market stuff you can buy for your car.
- Big bore exhaust - Tick
- 30Kw Sound System - Tick
- 6.5ltr Supercharged engine - Tick
You do all of that and then the back axle falls apart. So you go to the manufacturer and claim on the warranty.
When theyhave finished laughing they will tell you to get lost. You made changes to the item that was sold. That affected the operation.
You are So Out Of Luck
Now return to the IOS issue.
You bought an IOS device. YOU modified it and now you get malware.
Just how is this Apple's problem?
...exists in pretty much all phones (amongst other devices) although most would require some soldering on the PCBs, they are also used for forensic investigations -- or have completely separate circuits used just for forensics.
I don't remember much to be honest (like protocols etc) but I remember it from a forensics class I took.
The only surprising thing here is that they allow access to that circuitry via the normal device ports.
Besides it isn't like this just magically opened a way to exploit an OS that had never ever been exploited in the past. Ya see, this is what I don't get about the whole fanboyism thing, the divorce from reality. News Flash: ALL OPERATING SYSTEMS CAN BE EXPLOITED!!!
A wise person once said the only way to make a truly unhackable computer was to lock it in a safe and drop it in a hole and that is the truth. No matter how smart the guys that write the OS think they are there is somebody smarter out there and if they want to dedicate the time and energy they WILL find a way in, I don't care if it is cell, desktop, or server, I don't care if it is made by Apple, MSFT, or some Linux group. All it takes is will and knowledge and time and the knowledge and time parts get shorter all the time thanks to this little thing we called the Internet allowing those that want to hack to have plenty of places to learn.
As for TFA any security person will tell you that if you have access to the hardware you are 90% of the way there. I doubt Apple really cares much about this since it seems like to big of a PITA for the average Apple customer. Most folks aren't gonna be cooking up special cables and cracking the case just to jailbreak the thing.
But this does illustrate something I don't get about Apple, which is why they don't just do like Sony did with OtherOS before they screwed the pooch and take away the incentive to hack it in the first place? Just have a relatively simple way to call up a menu that says "By clicking here you give up your warranty in return for jailbreaking the device. Once chosen this CANNOT BE UNDONE" and then let the customer decide if they want to break it or not?
ACs don't waste your time replying, your posts are never seen by me.
Does it create tighter, faster code or increase the success of exploits?
Totally. Nobody would abuse that. No way.
ALL OPERATING SYSTEMS CAN BE EXPLOITED!!!
You're a moron.
Insecurity isn't an inevitability.
Non impediti ratione cogitationus.
If you can hold the computer in your hand, security has little to do with the operating system.
http://michaelsmith.id.au
While I agree with you from a theoretical standpoint, the complexity of modern operating systems more or less guarantees that nobody with a finite amount of time will ever be able to secure one 100%.
Write boring code, not shiny code!
Okay, then, CPU?
I think that it's absurd to have the opinion that nothing is unhackable. I think it's feasible to think that there may come a day when security gets tight enough that a computing system for consumer use could become exploit-proof. Look at the PS3. It wasn't until that USB boot exploit was discovered was the thing broken open.
Yes, it's a bit of special pleading, but, most attack vectors were covered. Sony did learn from the PSP. It's conceivable that there could be a day when the only way to hack a machine to run arbitrary code is to intercept the CPU itself, and even that's theoretically beatable.
Non impediti ratione cogitationus.
We want the schematics for the "hacker cable". /dev/tty.iap but the bootloader won't send anything on those pins at startup.
The schematic from the link in the TFA, ( http://www.ionetworks.com.au/files/serial_port.pdf ) using pins 12 & 13 of the dock connector is for a "accessory connection" cable and can be used from a jailbroken iPhone with
1% APY, No fees, Online Bank https://captl1.co/2uIErYq Don't let your $$$ sit in a no-interest acct.
Insecurity isn't an inevitability.
As long as there is a human at the keyboard, yes, it is.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Other sites seem to work fine with an edit feature.
ALL OPERATING SYSTEMS CAN BE EXPLOITED!!!
You're a moron.
Insecurity isn't an inevitability.
If you think your statement is true, you're the moron. Unless its a completely closed system, security is never perfect.
Perhaps I don't understand the context, but it appears to me TFA uses the word "modulo" where it means "minus".
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
And you're wrong - there are provably secure operating systems.
Then there are just plain scarily secure operating systems: QNX and (to lesser extent) VxWorks. QNX in particular has just about 2000 lines of kernel-level code which is highly audited, tested and probably damn near bug-free.
Similar approaches are already used in hypervisors. It's certainly possible to make a provably secure hypervisor, for example.
However saying that because Apple has excellent profits now with the phones locked doesn't at all mean that they couldn't have even more profits if they allowed an option (maybe for some extra money) to those who wanted this option to remove any sort of protection against USER using the device the way they wanted to
Apple already offers this option. It costs $649 to buy a Mac mini if you don't already own a Mac, and then $99 per year to join the iOS developer program.
Mod points are handed to the ppl who comment a lot. These same people don't read the articles and half the time don't even read the summaries.
You either need to give up the moderation system or have properly trained mods.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
> If you can hold the computer in your hand, security has little to do with the operating system.
That belief is, of course, completely mistaken and is the source of endless exploits inside wireless equipped LAN's and offices that "trust the people they work with". The threshold is deliberately left so low by both engineers and policy managers with this belief, as a matter of personal convenience, that rootkits and exploits run rampant inside "closed" networks and devices that entirely ignore local security as a matter of policy.
The very low security threshold of such access is ludicrous, and should _never_ have been permitted.
The back button on the HTC is unbelievably broken
Back on an Android-powered device always closes the frontmost window. It's not unlike Alt+F4 on a PC running Windows. Maybe you haven't picked up on it because web pages are treated as windows in the back stack.
And unless I'm refilling the wiper fluid, I never want to open the hood.
To continue the analogy, some companies' products don't even let you do that. You have to use the company's own brand of fluid, or the reservoir won't refill.
Instead of spouting venom, learn some self control. There is no need to edit posts.
If you need to edit it, you probably didn't need to write it.
If you're editing it because you misspelled something, take that as a sign that you should proofread before submitting. (guilty as charged)
Doesn't have to be 4 hours. I'd be happy with 1 minute. There is some defect in my brain that causes errors to appear upon posting that did not show up in Preview.
You are welcome on my lawn.
Hm, what am I missing here?
It requires an already jailbroken device. So you need to be root already. What additional functions does this allow you to access that you don't already can?
Assorted stuff I do sometimes: Lemuria.org
"I think it's feasible to think that there may come a day when security gets tight enough"
Umm the intertubes is a couple of decades old now and we're still no nearer to this. Your own example counteracts your argument
So... call me, I'll be waiting... (oh and there's another small problem - you can't prove that a system is unexploitable)
And the people shall be oppressed, every one by another, and every one by his neighbour Isaiah 3:5
>And you're wrong - there are provably secure operating systems.
Citation please?
And the people shall be oppressed, every one by another, and every one by his neighbour Isaiah 3:5
Unless its a completely closed system, security is never perfect.
I'm baffled as to why you think a closed system is somehow more secure. Security through obscurity is by no means "perfect".
On a separate note, I think the security of systems only really matter within the scope of possible attack. For example, it's not an 'exploit' if you can crash the system with a script if the system doesn't have another exploit that would allow an attacker to run the script. Clearly, a defense against such exploit should be in place to better harden the system but it's only an exploit if there are other exploits.
Nearly all systems should not be capable of a remote exploit and, is in that sense, secure. It is only when you start starting services like an SSH server or a SQL server where the possibility for remote exploits becomes evident. Fortunately, mobile devices don't have these kinds of services and any exploit depends on the user executing malicious code his/her self, intentionally or not.
Additionally, having hardware access is usually regarded as having a system completely under your own control. This makes mobiles a different ball game since you can't practically lock the phone behind steel walls. If hardware hacks requires software exploits which cannot be done by a malicious attacker, I don't see how that's a problem. This is only a problem to those who voluntarily use software exploits, open up their system, and allows attacker to have physical access to it.
In a nutshell, calling this cable hack an exploit is like saying that it's an exploit if a root user can run "rm -rf /".
Here's a link to implementation: http://ertos.nicta.com.au/research/l4.verified/
You can also check: http://en.wikipedia.org/wiki/Coyotos
Man, call me old school, but wiring up a max232 to serial lines isn't really something I'd call a major development. He managed to wire it to an Apple docking connector? He's sucking 3.3V from the interface and wired in an actual resistor? Wow.
The magic in this is knowing what the iPhone is going to do and how to get it in a debug mode where a serial port might be handy. That's useful.
I am surprised that it doesn't take much to impress this community. God forbid anyone ever had to do any hardware work. This is a serial port for crissake. BFD.
probably damn near bug-free.
The two words I've highlighted pretty much proves my point.
Write boring code, not shiny code!
Well, there _are_ provably secure OSes (seL4, Coyotos).
QNX is not formally proven to be secure, but in practice it is - I'm not aware of any vulnerabilities in its microkernel.
The hacking is for fun.
The problem being, a machine is more than an OS. Some NICs are insecure and one can hack into their microchips. That's a good place to do man in the middle attacks. Other exploits don't need root privilege to do their deeds. They'll target the running apps, not the kernel.
All in all, I must say that I don't know how you can prove an OS is secure (and I doubt it is an accurate description of security). You can prove there is a vulnerability by finding it. How do you prove there's no vulnerability ?
Write boring code, not shiny code!
Imagine that your phone only runs signed software. And the hypervisor continuously checks that all executable code in RAM is signed.
Now what? You can exploit an application, but it will be immediately detected by the hypervisor. Embedded firmware might dodge it, but it won't be able to do much - all the traffic that goes in/out of NIC is already untrusted.
It'll take a couple of generations of hardware to achieve this. But ultimately it WILL be done.
Back when Slashdot had "news for nerds" instead of a bunch of fanboys living in their basement, people would be excited about hacks like this. Instead, we get a back and forth by who haven't written a line of code in their life and know absolutely nothing about security. I don't know why I still read this crap.
It reminds me of the discussions on slashdot in the early days of virtualization (early 2000s). It was like "Of course it's secure: even if the VM is compromized, the virus cannot spread to the host." Except it can spread to the host. Because VMWare is not bulletproof either, and you can exploit the VGA drivers, USB drivers, etc. Especially if you're root on the VM.
The hypervizor thing will be the same IMO. You'll be able to target the encryption, the signing, whatever is exposed to the outside can be exploited. A TCP stack is also something pretty hard to secure.
The secure machine is the machine not connected to the outside world. Then again, it can be exploited if you have access to the machine physically.
Something easy to secure absolutely: An alarm clock. A microwave. Something basic. Not that I believe my microwave or alarm clock to be secure. What I'm saying is that such dumb down systems should be able to be secured absolutely.
Write boring code, not shiny code!
I think he meant closed as in, no way to get in or out. So you couldn't actually do anything with it.
They do if you're on AT&T.
Did, past tense. Due to customer demand for Amazon Appstore, AT&T has been unhiding "Unknown sources". Besides, AT&T phones have always supported adb install; Google won't let the manufacturer use Android Market without it.
All iPods/iPhones using the standard 30 pin connector (and some earlier on the headphone jack as well) have a serial port as two of the pins on the dock connector. It is there for accessories to communicate with the device. You need to have an NDA in place with Apple to get the protocol commands, which are a PITA and very limited in function.
Jailbreaking just opens up the serial port for use as a general-use port, by running different software on the device.
And you're a total fucktard, see how that works? Now name this mythical "unhackable" system pal. cells? Hacked. Consoles? Hacked. All the various popular OSes? Hacked. If you would have bothered to read my post instead of getting all butthurt you'd have read the same thing security guys have been proving for years.
1.-There is no such thing as an unhackable system, all it takes is time, will, and knowledge, and the time can be cut down by increasing knowledge of the system which can be gained from this wonderful tool we call the Internet.
2.-if you have physical access to the box? you are already 90% of the way there. That is because with physical access one can hack right into the board itself, by using a flash drive or as in TFA tying directly into the board itself.
So before you go slinging insults why don't you put up or shut up, huh? Lets see that unhackable system pal. because I got news for ya it doesn't exist and any moron who watches some of the webcasts from events like black hat would know why, it is because there are a hell of a lot of low level coders out there that live, eat, and breathe hacking. You point to a system and say "unhackable"? They are gonna do whatever it takes to break in, and they will sparky, they will.
ACs don't waste your time replying, your posts are never seen by me.
Lets see that unhackable system pal
Sure, try to hack a NAND gate.
Short of feeding it a crapload of volts and amps, there's not much you can do to really feed it some kind of input that'll fuzz it's output.
Non impediti ratione cogitationus.
Riiiight, because the average person says 'hey, let me have one of them NANDgates, along with fries and a coke". GIVE ME A BREAK! WTF good is a single NAND gate? Show me a system in actual popular usage that is "unhackable" and THEN you'll have a point, otherwise you're just trolling.
ACs don't waste your time replying, your posts are never seen by me.
One of the beta tests of the current interface (you can tell this is a joke already, can't you!), had an accurately-labelled "Submit" button. It read
"Press here once you've checked your URLs, your spelling, and grammar and you're really sure that you want your public persona to be irrevocably associated with what you've written."
But for some obscure reason, the UI people thought that might just possibly be intimidatingly accurate.
Personally, I've always read the word "Submit" as meaning "that's it ; it's gone ; you're committed".
Wouldn't it be wonderful if they included a button that allowed you to check the visual form of your posting without actually permanently putting it on public record above your public persona. They could call it "Preview". It would be almost like having the ability to view your post and "edit" it again before posting it permanently.
I realised - that last line implies that you could "post" something and it not be permanent. Oh, what hilarity.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"
I cant count the numerous number of times I have taken my HTC out of my pocket to find my penis or keys
I dunno what to think about the parent post.
On the one hand, he sounds smart, reasoned, and passionate about his tech experiences, so he sounds like a geek.
On the other hand, a real geek surely would obsessively COUNT how many times they took an HTC out of their pocket to find their penis.
Please explain to me how you got rid of the human error factor.
The thing is: if it's accesable then it's accesable. Yes you can make a computer secure by letting it being able to do nothing, but then it's useless. If you let people acces it through the internet, someone else can too. The problem is that computers are digital. No matter what authentification system is in place, the system is binary. Everybody can copy that code and use it themselves, provided that they are smarter than the creator.
Here be signatures