Slashdot Mirror


iPhone Hacked In Under 60 Seconds Using Malicious Charger

DavidGilbert99 writes "Apple's iOs has been known as a bastion of security for many years, but three researchers have now shown iPhones and iPads can be hacked in just under 60 seconds using nothing more than a charger. OK, so it's not just a charger — but the Mactans charger does delete an official app (say Facebook) replacing it with an official-looking one which is actually malware which could access your contacts, messages, emails, phone calls and even capture your passwords. Apple says it will fix the flaw, but not until the release of iOS 7, the date of which hasn't been confirmed yet. So watch out for chargers left lying around ..." (For less in the way of auto-playing video ads with sound, check out the Mac Observer's take, which concludes "[I]t's nifty that Apple is addressing the issue in iOS 7. We'd also like to see it fixed in iOS 6. Apple has historically seen iPhone users upgrade to the newest version iOS in staggeringly high numbers, but eliminating this problem across the board seems the wiser choice.")

170 comments

  1. Translation: by CanHasDIY · · Score: 4, Insightful

    The quickest way to get PWND is to give someone else physical access to your device.

    Always has been true, and likely always will be.

    --
    An enigma, wrapped in a riddle, shrouded in bacon and cheese
    1. Re:Translation: by Anonymous Coward · · Score: 2, Informative

      In the 2011 Pwn2Own contest, Charlie Miller and Dion Blazakis "PWND" the Iphone 4 using a mobile Safari vulnerability.

      Apple is almost always a loser at the Pwn2Own events.

    2. Re:Translation: by Anonymous Coward · · Score: 0

      Apple is almost always a loser at the Pwn2Own events.

      Except for 2012 and 2013.

    3. Re:Translation: by Anonymous Coward · · Score: 0

      Having access to a couple of data pins on a device is not "physical access" any more than being on the same wired/wireless network is.

    4. Re:Translation: by Anonymous Coward · · Score: 0

      That being said, you shouldn't plug your phone into unknown chargers, because there's no known fix to the 110VAC exploit.

      CATCHPA: concern

    5. Re:Translation: by Capsaicin · · Score: 1

      The quickest way to get PWND is to give someone else physical access to your device.

      In the 2011 Pwn2Own contest, Charlie Miller and Dion Blazakis "PWND" the Iphone 4 using a mobile Safari vulnerability.

      Relevance?

      That mobile hacks are possible hardly disproves OP's point (or addresses it any pertinent way).

      --
      Better to be despised for too anxious apprehensions, than ruined by too confident a security. --Edmund Burke
    6. Re:Translation: by blueg3 · · Score: 1

      No, but there's a good mitigation: the first guy who uses that charger probably alerts others. A persistent, undetectable hack is a lot more useful, since it can affect more than one person before being noticed.

    7. Re:Translation: by Plumpaquatsch · · Score: 1

      In the 2011 Pwn2Own contest, Charlie Miller and Dion Blazakis "PWND" the Iphone 4 using a mobile Safari vulnerability.

      Apple is almost always a loser at the Pwn2Own events.

      Pwn2Own only allows 0-day hacks. If somebody else goes wild with the exploit you found on the day before the contest, you can't win. That's why everybody focused on the platform where there wasn't a new exploit in the wild every other day. Until they couldn't find exploits there anymore - no hacked Apple products in Pwn2Own since 2012.

      --
      Of course news about a fake are Fake News.
    8. Re:Translation: by CanHasDIY · · Score: 1

      Having access to a couple of data pins on a device is not "physical access" any more than being on the same wired/wireless network is.

      You're kidding, right?

      Tell me you're kidding.

      --
      An enigma, wrapped in a riddle, shrouded in bacon and cheese
  2. Re:Why can't Iphone / ipad have usb port for charg by The+MAZZTer · · Score: 5, Informative

    That wouldn't solve the problem? USB chargers on Android can install apps and transfer files either way if the device has USB debugging enabled. If iPhones used USB the data protocols wouldn't be changed and would have the same capabilities...

  3. Jailbreak exploit opportunity by Dynedain · · Score: 1

    So does this mean you could write a jailbreak for iOS device using a modified charger? If so, how is this any different than plugging the device into a computer?

    --
    I'm out of my mind right now, but feel free to leave a message.....
    1. Re:Jailbreak exploit opportunity by AlreadyStarted · · Score: 5, Informative

      The "modified charger" they describe is in fact a computer.

    2. Re:Jailbreak exploit opportunity by Em+Adespoton · · Score: 4, Informative

      Interestingly, for the hack these guys created to work, the attacker must have a valid developer's license, and the target iOS device must already be jailbroken. The first bit allows them to query Apple's dev site for the debug key for your specific iOS device; the second is required to get the loaded software to actually run on the device.

      HOWEVER, the same technique can be used to read all data available in userspace on the phone, so improperly stored passwords, plus all other app data and configuration data could be grabbed in this manner.

      If Apple can fix this in iOS 7, I'm expecting the jailbreak community to create a fix (that will be loaded as part of the jailbreak process) in short order. Something similar to bluetooth pairing for debug and filesystem access would be an extremely good idea, plus it would close a number of outstanding attack vectors in iOS devices, not just the ones presented.

    3. Re: Jailbreak exploit opportunity by Anonymous Coward · · Score: 0

      It does not jailbreak the device or require a jailbroken device. It installs a developer provisioning profile on the phone, which can be done automatically over USB and enables application sideloading.

    4. Re:Jailbreak exploit opportunity by Anonymous Coward · · Score: 0

      Its just a computer that looks like a charger.

      Also it isn't a jailbreak - it uses the accessory connector protocol to install Apps ( that are still code-signed, sandboxed and inside the jail ) without user intervention.

      One of the tenets in iOS is the device trusts you if you know the passcode, and the device trusts what you plug it in to if you connect it to something while its unlocked.

      The novelty is making something you shouldn't trust (a random computer you have no knowledge of ) look physically like something people generally do (a charger).

    5. Re: Jailbreak exploit opportunity by Anonymous Coward · · Score: 0

      It installs a developer provisioning profile on the phone...

      That can also be revoked and leave a paper trail back to the criminal.

    6. Re:Jailbreak exploit opportunity by samkass · · Score: 4, Informative

      No, it doesn't require the phone to be jailbroken. It does, however, require the attacker to have a paid Apple Developer account with a valid credit card, and it digitally signs all the malware with that developer's information, and limits the total number of devices ever attached to that account to 100 without calling Apple and requesting a reset, and requires the attacking "charger" device to be online at the time of the attack. It also requires the phone to not be in its lock screen, so for it to work you have to manually unlock it and type in your passcode while it's plugged in.

      So it's pretty much a proof-of-concept attack that's not very practical yet, but could probably have been built upon if Apple hadn't already put a fix into the version of the OS coming out soon which, if history is a guide, 90%+ of the iOS installed base will be on in a few months.

      --
      E pluribus unum
    7. Re: Jailbreak exploit opportunity by Anonymous Coward · · Score: 0

      Makes the recent attack on the dev servers - which grabbed a whole lot of credentials - a lot more interesting.

    8. Re: Jailbreak exploit opportunity by thoromyr · · Score: 1

      agreed. and perhaps explains why Apple locked everything down and brought it back up so as to ensure integrity.

  4. they need to backport it to ios 6 by larry+bagina · · Score: 0

    Some people are jizzing their pants over iOS 7 but I think a lot of us will refuse to "upgrade".

    --
    Do you even lift?

    These aren't the 'roids you're looking for.

    1. Re:they need to backport it to ios 6 by Anonymous Coward · · Score: 0

      I'm not aware of anything bad in iOS 7. Why would you not upgrade?

    2. Re:they need to backport it to ios 6 by XxtraLarGe · · Score: 1

      I'm not aware of anything bad in iOS 7. Why would you not upgrade?

      Can't speak for others, but my iPhone 4's performance became quite sluggish after I upgraded to 6. I don't plan to get a new phone any time soon, so I'll probably stick with 6 for the time being.

      --
      Taking guns away from the 99% gives the 1% 100% of the power.
    3. Re:they need to backport it to ios 6 by vux984 · · Score: 1

      I'm not aware of anything bad in iOS 7. Why would you not upgrade?

      Well not everyone loves neon gradients as much as Jony Ive. Not that I was a fan of some of the ridiculous "skeuomorphic" stuff either though.

      But honestly that's all behind me as I've got a Samsung Galaxy 3 now, and seriously doubt I'd switch back to Apple phones, unless there is another big shakeup before my next upgrade cycle.

      To wind our way back on topic though my daughter has my iphone 3GS...(I had a new battery put in it and its good as new) Now, she won't be upgrading to ios7 either, because the 3GS isn't supported. So yeah, security fixes for ios6 would be pretty welcome.

    4. Re:they need to backport it to ios 6 by plover · · Score: 1

      I'm not aware of anything bad in iOS 7. Why would you not upgrade?

      To preserve my jailbreak. I certainly won't downgrade to a new iOS until I know it's compatible with my Cydia apps.

      New versions of iOS have become very ho-hum for the users. In the early days, they were exciting. Apple used the upgrades to add actual missing features, like copy/paste and multitasking. Consumers really wanted the latest and greatest, because the new features made an actual difference to them. Plus, iOS upgrades were required to download the latest apps, as new APIs were introduced to support things like front facing cameras, auto focus, iPad compatibility, etc.

      Things became tricky, though. As they added features they bloated the OS, making the old iPhones perform poorly. But they got lucky. Most customers were already conditioned to previous phones "getting old and slow", that battery performance dropped dramatically after a year, and they wanted the new features anyway. They bought new iPhone hardware to compensate every time their 2 year contracts were up. So it turned out that it was OK with customers, because the latest iPhones were always "cool" and better, and all sins were quickly forgiven.

      Apple couldn't buy enough wheelbarrows to haul away all the money they made with that strategy.

      With iOS6, though, they may have finally poisoned the goose laying the golden Apples. Ordinary customers finally noticed that Apple was screwing them when they got their nice Google map app taken away and replaced with the shitty Apple Map. ("You want transit directions? You peasant! If you must, click here to download your city's transit app, and while you're at it, borrow a quarter from the guy next to you.") With that incredibly stupid mistake, lots of iPhone owners realized that Apple wasn't "benign" with their upgrades, and started to wonder just how badly they've been screwed over the years. Ordinary people are now likely to be somewhat wary of new iOS releases.

      It remains to be seen if people will simply accept whatever they shovel into iOS7. There is already complaining about the new Fisher Price look of the interface, and that there are no real features of value. iTunes Radio is the closest thing to "new" in this device, but people who like that sort of thing already have Pandora, and they don't want to change because their player already knows their tastes. iOS7 might not get the swift uptake that their previous OSs saw.

      --
      John
    5. Re:they need to backport it to ios 6 by Anonymous Coward · · Score: 0

      I know everyone wants ios7, I have it and everyone I show it to want it now...

    6. Re:they need to backport it to ios 6 by jbolden · · Score: 1

      The data doesn't show that. It shows that Apple has trained the userbase to upgrade very quickly.

    7. Re:they need to backport it to ios 6 by jbolden · · Score: 2

      Apple pulled Google maps because they didn't want to agree to the privacy rules Google wanted. The cost to Apple has ben hundreds of millions if they aren't up a billion yet. You can agree with Apple's call here or not, but screwing the customers financially was not the motivation.

    8. Re:they need to backport it to ios 6 by plover · · Score: 1, Flamebait

      Apple pulled Google maps because they didn't want to agree to the privacy rules Google wanted. The cost to Apple has ben hundreds of millions if they aren't up a billion yet. You can agree with Apple's call here or not, but screwing the customers financially was not the motivation.

      They may have said "privacy", but that was a smokescreen. It was about nothing but money. Apple is in head-to-head competition with Google, and allowing their primary competitor a choice seat on their home screen and garnering the search, location, and resultant ad revenue was an affront they could no longer abide.

      Apple truly believed they could get away with it and that customers wouldn't care. They believed that they would deliver such a hot-shit mapping app with useful turn-by-turn screens that consumers would just love it like they loved everything else Apple produced. They committed themselves to delivering on that belief. And as release day arrived, and initial reviews came back, they began to realize that buying TomTom's map was buying little more than a pig in a poke, and began to wonder if it wasn't a mistake. But they had no idea of the size of the PR nightmare they were creating, and they did not expect the backlash that came out of betraying their fans.

      I seriously doubt that iOS7 will be adopted at the rate iOS6 was. But I may be underestimating the power of auto-updates. A large number of people just won't care no matter what Apple does.

      --
      John
    9. Re:they need to backport it to ios 6 by Anonymous Coward · · Score: 0

      You'll probably also want to avoid iOS 8, iOS 9, and iOS 10.

    10. Re:they need to backport it to ios 6 by larry+bagina · · Score: 1

      They went overboard on the flat effect. Have you seen the icons? It looks like a south park construction paper iPhone.

      With the changes in UIControls, apps that aren't upgraded look like a bag of ass. Or are non-functional (the navigation bar is now larger and covers the view underneath by default).

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    11. Re:they need to backport it to ios 6 by jbolden · · Score: 1

      Today Google maps is an approved app on the app store. You can simply claim motivations that both Apple and Google deny but unless you have inside information I'd assume Apple and Google are telling the truth about their dispute. Moreover Google remained the default search engine which had more revenue potential. As for "ad revenue" there wouldn't be any ad revenue under Apple's approach, that was the point.

    12. Re:they need to backport it to ios 6 by Anonymous Coward · · Score: 0

      No. The real reason for pulling Google Maps as standard was that Google refused to make the iOS version feature complete compared to the Android version.
      Google refused to implement directions for example. That's why Apple was forced to kick Google and make their own map service.

      BTW : Apple Maps is much better now. Still a lot to do, but not as horrible as it was when they started.

    13. Re:they need to backport it to ios 6 by MachineShedFred · · Score: 1

      What is this auto-update you speak of?

      To upgrade iOS, you have to actually tell it to upgrade. It will only notify you when one is available.

      --
      Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
  5. Re:Why can't Iphone / ipad have usb port for charg by SIGBUS · · Score: 5, Insightful

    How many Android handsets come with USB debugging enabled by default?

    --
    Oh, no! You have walked into the slavering fangs of a lurking grue!
  6. The jokes just write themselves by safetyinnumbers · · Score: 5, Funny

    delete an official app (say Facebook) replacing it with an official-looking one which is actually malware which could access your contacts, messages, emails

    1. Re:The jokes just write themselves by Anonymous Coward · · Score: 0

      Ahh.... good catch... =P

  7. Re:user's brain gets hacked, by Anonymous Coward · · Score: 3, Funny

    If they're using an iPhone, they already succumbed to brain hacking by Apple's marketing.

  8. "Bastion of security" by Ferzerp · · Score: 5, Insightful

    Since when? iOS has had repeated and nearly constant flaws that have allowed for compromises both locally and remotely (via webpages). At this point it's such a given that this is mostly a non story.

    I thought the RDF had dissipated, but I guess not.

    1. Re:"Bastion of security" by Anonymous Coward · · Score: 0

      Apple has one thing right: Jailbreaks are becoming very scarce. The last time we had a boot-level one was when the iPhone 4 was out. At best there is a 1-2 week window when a JB comes out and when Apple does an update, slamming it shut.

    2. Re:"Bastion of security" by Nemyst · · Score: 2

      Why exactly is that "right"? In what way is stopping users from using their devices in the way they desire a good thing? One of the best things about Android, especially Google's Nexus phones, is that rooting is just about always possible. For Nexus phones, it's downright trivial and supported by the OS and hardware. Sure, it might not be necessary for 99% of users. It doesn't make it any less of a legitimate action a user should be able to take.

    3. Re:"Bastion of security" by amicusNYCL · · Score: 2

      The last time we had a boot-level one was when the iPhone 4 was out.

      I don't know what you mean by a "boot-level" exploit, but evasi0n was out in February, several months after the iPhone 5 launched. That particular exploit does modify boot files and gain access to the kernel, if that's what you mean by "boot-level".

      At best there is a 1-2 week window when a JB comes out and when Apple does an update, slamming it shut.

      The patch that fixed the exploits used by evasi0n was released more than a month after evasi0n went public.

      If you're going to shill for Apple, it's probably good to at least stick to facts. But then it wouldn't really be shilling, would it?

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    4. Re:"Bastion of security" by blueg3 · · Score: 4, Insightful

      It's right because the jailbreaks are all serious security vulnerabilities. That's how they work, and having them around is dangerous.

      Now, it might be nice if Apple allowed people to have the capabilities provided by a jailbreak if they want them. That's not the same as having a jailbreak.

    5. Re:"Bastion of security" by tlhIngan · · Score: 3, Informative

      Since when? iOS has had repeated and nearly constant flaws that have allowed for compromises both locally and remotely (via webpages). At this point it's such a given that this is mostly a non story.

      Wow, that remote exploit was for iOS 4, an OS that shipped in 2010-2011. There's only one phone stuck on iOS 4 - the iPhone 3G - everyone else is able to run a higher version.

      Yes, I suppose if one is used to Android, they would think a ton of people still use iOS 4, but no. After all, iOS 4 came out around the time of Gingerbread, which is still used by a third of Android phones.

      Of course, iOS 6 has proven to be EXTREMELY difficult to compromise. It took 6 months before the first jailbreak came out (for 6.1.0) and a bunch of critical flaws were discovered including unlock screen flaws, resulting in 6.1.1, 6.1.2 and the current version of 6.1.3.

      Unfortunately, 6.1.3 closed the flaw the jailbreaking flaw and no new one has been found since. Old devices have tethered jailbreaks for 6.1.3 but that's it. New ones like the iPhone 5 and iPad 4 ... no jailbreak exists.

    6. Re:"Bastion of security" by tlhIngan · · Score: 2

      Now, it might be nice if Apple allowed people to have the capabilities provided by a jailbreak if they want them. That's not the same as having a jailbreak.

      How would you do that without giving people the chance to completely hose their machines like PCs?

      Jailbreaking is to get out of the "jail" that iOS puts on applications, so it's basically giving root to iOS users.

      If you give people the ability to, they will do it because someone will tell them to do it. There is no way around dancing pigs. Hell when jailbreaking was a popular activity, there was a Rickrolling worm that spread amongst jailbroken iPhones. And another one that stole banking information.

      Why? Because people jailbroke as "something neat" and then followed some instructions that said to install OpenSSH in order to do something that required jailbreaking (pirated apps? unique apps? who knows or cares).

      Point being, give people the ability to, and they'll do it without regards for security.

      It's just like the "Allow non-market apps" checkbox on Android - I'm fairly certain most people have it checked without regard for WHY it's there in the first place. Perhaps they saw some free app on Amazon? Or bought something from Humble Bundle? If you follow how to install those apps, they say to check it.

    7. Re:"Bastion of security" by blueg3 · · Score: 1

      Yes, that is the problem. I said "might be nice". There are some benefits (the reasons people jailbreak) and there are lots of downsides, like you indicate.

      The fact of the matter is that you can get the capabilities of jailbreaking right now and people do it. The mechanism is jailbreaking via a vulnerability. It would at least be better if they had the same capabilities but without the vulnerability.

  9. does delete an official app (say Facebook) by Skiron · · Score: 1

    Sounds like a good idea to me - ROLL IT OUT

    1. Re:does delete an official app (say Facebook) by noh8rz10 · · Score: 2

      Sounds like a good idea to me - ROLL IT OUT

      Sounds like a good idea - FOR ME TO POOP ON!

  10. Re:The Internet of Things... by Anonymous Coward · · Score: 5, Insightful

    Apple's iOs has been known as a bastion of security for many years

    Uh, what? The fuck it has. Guess it just goes to show what a massive marketing campaign will do for your public image. The platform has never been any less hackable than the competition, especially when you're talking physical access to the device.

  11. A bastion of security? by Anonymous Coward · · Score: 0

    Jailbreaking depends on security vulnerabilities, which every version of iOS has been susceptible to. How is iOS a bastion of security?

    1. Re:A bastion of security? by Anonymous Coward · · Score: 0

      Could you please link to an untethered iPhone 5/iOS 6.13 jailbreak? Thank you.

  12. Re:Why can't Iphone / ipad have usb port for charg by niftymitch · · Score: 1

    That wouldn't solve the problem? USB chargers on Android can install apps and transfer files either way if the device has USB debugging enabled. If iPhones used USB the data protocols wouldn't be changed and would have the same capabilities...

    Almost.

    I have seen USB wire things that do not have data connected (at AT&T shops).

    At the time I passed on the $9 cable because I wanted to move stuff on and off my phone via USB.

    Now that someone has done this hack I will get and keep a no data USB wire for travel and other situations where I might plug into a random who knows USB charger and not my own charger.

    It does tell me that the TLA guys now have a window into my soul should they replace my charger at home with their device that sends my soul to mars.

    --
    Truth is stranger than fiction, but it is because Fiction is obliged to stick to possibilities; Truth isn't. Mark Twain.
  13. "...The wiser choice." by idontgno · · Score: 0

    Apple has historically seen iPhone users upgrade to the newest version iOS in staggeringly high numbers, but eliminating this problem across the board seems the wiser choice.

    Nonsense. It's absolutely the wisest thing Apple could possibly do. Adding the spur of an outstanding unpatched "OMG I'm PWND" vulnerability to the carrot of the news "OMG SHINY" is absolutly brilliant. A wonderful way to counter sagging uptake.

    Oh, you mean "wisest in terms of supporting your customer?." How quaint.

    They're not your customer once you have their money.

    --
    Welcome to the Panopticon. Used to be a prison, now it's your home.
  14. Bastion of security? by scot4875 · · Score: 4, Informative

    I'm sorry, but if every version of your OS is trivially jail-breakable (with, for example, exploits that amount to root privilege escalation by simply visiting a web page on the device's browser), you are NOT a bastion of security.

    You can argue that Apple does a better job of "securing" their app store than Google does, but that doesn't make the devices themselves any more secure. Just because something trivially exploitable hasn't been exploited (that you know of ... yet) doesn't make it secure.

    --Jeremy

    --
    Jesus was a liberal
    1. Re:Bastion of security? by Culture20 · · Score: 1

      Submitter actually typed Bastard of Security. Damn you, autocorrect!

    2. Re:Bastion of security? by Anonymous Coward · · Score: 0

      Which versions of iOS are vulnerable to a remote root privilege escalation ?

      I'll give you a hint - nothing that you can currently install on any iOS device ever shipped ( ie Apple revoked the signature for the vulnerable iOS versions long ago, and aside from people disciplined enough to keep shsh blobs for everything, there's no way to revert back to the vulnerable versions )

      Even with local exploits, there hasn't been a jailbreak that did not require prior knowledge of the device passcode since Apple moved from the A4 to A5 CPU. I think Apple is likely far less concerned about people who own their phones stuffing around with them, than something that can jailbreak a locked phone with no prior trust established.

      iOS 5 and 6 can be configured in what is called "supervised mode", which breaks the promiscuous trust the device has in the local connector, and are not vulnerable to this issue ( nor indeed can such devices currently be jailbroken unless they are A4 or earlier processor based). Apple released a tool, called Apple Configurator, that could enable this, shortly after iOS 5 was released.

      Prior to supervised mode becoming available, use of charge-only cases or battery cases was the mitigation eg Mophie Helium. Such cases provide a USB charge port with no data signals through to the dock connector or lightning connector on the device.

      The actual issue isn't new, you could have hidden computer in the furniture, such as a Mac Mini running Xcode and some scripting, and have done this at any time since 2008 - the novelty in what has been presented is repackaging it into a relatively innocuous package. Kudos to the team who did it for following it through to a decent demonstration.

      A supervised A5 or A6 based iOS device, running iOS 6, with a moderate complex passcode, is bloody hard to compromise if you don't know the passphrase. Your best bet is not to attack the device itself, but target where the device backs up and syncs its data to ( iTunes host computer, iCloud account details, Dropbox etc )

      Given Apple's created an OS ecosystem where the upgrade/patching rates are very high - they usually hit 50% of installed base within 2-3 months of release, and iOS 6 passed 90% of installed base some time in the first half of 2013, it is a somewhat bullshit call to dredge up issues that are 3-4 years old, and long ago fixed, on the platform.

      (Its more, but not completely, fair to dredge up old issues with Android, because such a high proportion of the installed base is on old, unpatched versions. There are specific models of Android phone that in the right configuration are every bit as hard, or harder, to compromise as an iOS device, but you can pretty much count these on one hand, and the configuration to get there is both more complex, and requires explicit support from the OEM hardware vendor to get secure bootloader support for your customised build. )

    3. Re:Bastion of security? by thoromyr · · Score: 2

      this post is both informative and insightful. I can only hope that the moderators notice. I was worried about this until I found out that you have to unlock the device. Oh, wait, it also requires a developer account -- it cannot actually install unsigned code and have it run. It also requires an Internet connection. Oops.

      Don't get me wrong: this is bad. But for those who are security conscious (that is, actually use a passcode) it is unlikely to be developed into an effective attack before the patch is in place. And it drives home the fact that physical access can be used to bypass otherwise effective controls. For the vast majority of users (ios or otherwise) who don't even use a passcode? The evil maid doesn't even need this.

  15. Move along, nothing to see here by 0xdeadbeef · · Score: 0

    This is just more mindless Google fanboy anti-Apple hate.

    It's not like this a trojan you have to turn on the installation of non-market applications and go to a pirate app store to get installed. You actually have to have the device.

    And this is just like a jailbreak, so it is a good thing.

    1. Re:Move along, nothing to see here by Em+Adespoton · · Score: 2

      This is just more mindless Google fanboy anti-Apple hate.

      It's not like this a trojan you have to turn on the installation of non-market applications and go to a pirate app store to get installed. You actually have to have the device.

      And this is just like a jailbreak, so it is a good thing.

      Actually, this isn't mindless. This has been a known security issue in iOS since iOS 3 days, that Apple hasn't bothered to fix.

      See this article coming out of DEFCON 2011:
      http://nakedsecurity.sophos.com/2011/08/19/is-juicejacking-the-new-firesheep/

      So unless you carry around a charging cable with the data pins removed or never charge at a USB port you don't own yourself, this is an issue (and has been for years).

      Google (partially) fixed this on Android when noise first started being made in late 2010, but Apple didn't. Of course, due to fragmentation, that only means it's fixed if you bought your Android phone after mid-2011 or have an upgrade that implements the fix -- but Apple seems to be fragmenting within its own ecosystem, as this fix is iOS 7, and there are now a large number of iOS devices in every day use that aren't won't run iOS 7.

    2. Re:Move along, nothing to see here by Plumpaquatsch · · Score: 1

      This is just more mindless Google fanboy anti-Apple hate.

      It's not like this a trojan you have to turn on the installation of non-market applications and go to a pirate app store to get installed. You actually have to have the device.

      And this is just like a jailbreak, so it is a good thing.

      Actually, this isn't mindless. This has been a known security issue in iOS since iOS 3 days, that Apple hasn't bothered to fix.

      See this article coming out of DEFCON 2011:
      http://nakedsecurity.sophos.com/2011/08/19/is-juicejacking-the-new-firesheep/

      So unless you carry around a charging cable with the data pins removed or never charge at a USB port you don't own yourself, this is an issue (and has been for years).

      Google (partially) fixed this on Android when noise first started being made in late 2010, but Apple didn't. Of course, due to fragmentation, that only means it's fixed if you bought your Android phone after mid-2011 or have an upgrade that implements the fix -- but Apple seems to be fragmenting within its own ecosystem, as this fix is iOS 7, and there are now a large number of iOS devices in every day use that aren't won't run iOS 7.

      Yes, this is mindless, because it's an issue with all mobile OSs - funny how you managed to find an article that pretends otherwise http://managedsolutions.com/tag/juice-jacking/ doesn't.

      BTW: there are commercial chargers that remove malware from Androids http://kapricasecurity.com/ - you really believe the opposite can't be done?

      --
      Of course news about a fake are Fake News.
  16. Re:Why can't Iphone / ipad have usb port for charg by ackthpt · · Score: 1

    Why can't Iphone / ipad have usb port for charging and not high priced apple changes with iffy knock offs?

    Jobs wanted it so. (not the iffy knock offs, he hated those)

    --

    A feeling of having made the same mistake before: Deja Foobar
  17. The real question is by jonathanjespersen · · Score: 0

    Does the fake charger still charge the phone?

    1. Re:The real question is by O-Deka-K · · Score: 1

      No, it charges your credit card.

  18. Quite misleading by ernest.cunningham · · Score: 4, Informative

    The charger is a mini linux machine what needs to use an apple developer account to dynamically add the devices UDID to the developer portal.
    It then signs the malicious app and installs it.
    It takes advantage of ad-hoc distribution and would require a new Apple developer account every 100 devices.

    The only real mastery of this hack is that it can be concealed to look like a charger due to the small footprint of the linux PC. Otherwise, I could do the same thing with physical access to the phone.

    Still, a fun wee hack and novel approach.

    1. Re:Quite misleading by Anonymous Coward · · Score: 0

      I'm still not using strange chargers anymore ... man this has got me spooked.

      Oh and re your sig: The fact that NZ is not a state of Australia is not a matter of Geography, but of History. Remember on the first round of voting NZ accepted, while NSW rejected, federation. But that would never have done ...

    2. Re:Quite misleading by Anonymous Coward · · Score: 0

      Being that geography is the study the earth and humans I would disagree :)
      Human and regional geography covers the study of human society and understanding of, or defining the uniqueness, or character of a particular region that consists of natural as well as human elements.

      It is certainly a well within the realms of a geography lesson.

    3. Re:Quite misleading by zarmanto · · Score: 2

      The charger is a mini linux machine what needs to use an apple developer account to dynamically add the devices UDID to the developer portal. It then signs the malicious app and installs it. It takes advantage of ad-hoc distribution and would require a new Apple developer account every 100 devices.

      Everything that Ernest said, plus one more important note: Your phone must be either unlocked or not passcode/password protected, in order for this exploit to function. (Just another good reason to use what should be common sense security precautions, really.)

  19. well, duh. by sootman · · Score: 1

    The "charger" port is, in fact, a USB port (or something similar) so yeah: if you don't have physical security, you don't have security, just like everything else.

    Also, "Apple... will fix the vulnerability in the iOS 7 release" is not the same as "Apple has said they won't fix this in iOS 6." We'll have to wait and see what they say/do before passing judgement. (Radical idea, I know.) Apple was selling 3GSs with iOS 6 less than a year ago, and as far as I know, those little guys won't run 7.

    --
    Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
    1. Re:well, duh. by amicusNYCL · · Score: 2

      Apple was selling 3GSs with iOS 6 less than a year ago, and as far as I know, those little guys won't run 7.

      And you're thinking that's a reason why Apple would support the people who aren't paying them money anymore instead of trying to push them to buy the new version?

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    2. Re:well, duh. by Anonymous Coward · · Score: 0

      iOS 7 will be available, for free, all the way back to the iPhone 4 released over 3 years ago.

  20. Re:The Internet of Things... by Anonymous Coward · · Score: 0, Troll

    Exactly, except Apple products are usually more crackable than the competition, as proven in almost every one of the Pwn2Own events.

  21. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    That wouldn't solve the problem? USB chargers on Android can install apps and transfer files either way if the device has USB debugging enabled. If iPhones used USB the data protocols wouldn't be changed and would have the same capabilities...

    What port do you plug your iPhone into if it isn't the USB port?

    USB only defines a standard connector and a wire level protocol. What the common connector would solve is having to have X number of cables/chargers. With my Android micro-usb equipped phone, I can use any other micro-usb charger or cable. With the iPhone you have to have a special cable or charger.

  22. Re:Why can't Iphone / ipad have usb port for charg by mlts · · Score: 4, Insightful

    Even with USB debugging enabled (which some handsets constantly nag to have it turned off), Android handsets use a public/private key system. If the charger tries to get access, the phone will ask if it should have full data rights to it.

    Of course, this means that if someone clicks OK, they are hosed, but it is better than just sticking an adapter on and doing dirty work without knowing the device's PIN or password.

  23. lol Bastion of Security? by Anonymous Coward · · Score: 0

    Only because nobody cared enough to spend any time hacking them...

    1. Re:lol Bastion of Security? by Anonymous Coward · · Score: 0

      Yeah, because there's absolutely no devices out there running iOS.

      It's probably a good thing that you posted AC, because you're an idiot.

  24. It does use USB for charging, USB more dangerous by SuperKendall · · Score: 0

    Why can't Iphone / ipad have usb port for charging and not high priced apple changes

    The Apple chargers just supply a USB port power. The iOS devices can all plug into any USB port to charge...

    The ironic thing is that if Apple did in fact make "apple changes" then it would be HARDER for this attack to work, because you'd have to re-create the Apple charger and the charger would have to have a data line into the phone, unlikely.

    In fact, ANY device that uses USB to charge is potentially prone to attacks where the "charger" is really a computer attempting to mount the device in the most literal sense. That could me quite a lot more true of Android than iOS...

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  25. Re:Why can't Iphone / ipad have usb port for charg by Nemyst · · Score: 1

    Well, the fact Apple's connector fits both ways is a big plus. However, I would rather have seen a new USB standard with that feature than a proprietary connector doing it, and I'm sure Apple could've joined the board to push that, so it most certainly doesn't excuse them.

  26. Bogus summary by 93+Escort+Wagon · · Score: 4, Funny

    If this charger deletes the Facebook app, I don't think that qualifies as "malware".

    --
    #DeleteChrome
  27. Wasted jailbreak by ZorinLynx · · Score: 1

    Whatever flaw they are using to hack the phone is a possible jailbreak exploit that they are needlessly wasting.

    At the very least they should let the jailbreak community at this first, THEN show off the malicious charger. At this rate we'll never see a JB for iOS 7!

    1. Re:Wasted jailbreak by Anonymous Coward · · Score: 0

      It's a well known flaw already. The only thing new is building a charger to exploit it.

    2. Re: Wasted jailbreak by Anonymous Coward · · Score: 0

      It's not a vulnerability, it's a series of design mistakes. Mostly it's that the phone doesn't require user approval or even notify the user about various management operations over USB.

  28. Disservice to yourself by SuperKendall · · Score: 0

    I think a lot of us will refuse to "upgrade".

    iOS 5 was an "upgrade".

    iOS 6, and iOS 7 have been really nice updates - iOS7 especially is very useful. It's the first beta OS I have ever installed on my main phone because I found it too useful to not have daily.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  29. "Nifty" by Anonymous Coward · · Score: 0

    >[I]t's nifty that Apple is addressing the issue in iOS 7. We'd also like to see it fixed in iOS 6.

    Only Apple gets away with this...

    Huge security hole, and hey, it's "nifty" that they are going to eventually fix it if you upgrade your OS.

    Thanks...

  30. Only locally, not remote by SuperKendall · · Score: 2

    Since when? iOS has had repeated and nearly constant flaws that have allowed for compromises both locally and remotely (via webpages)

    There was one such remote vulnerability, via PDF, some years ago... none since then I know of.

    There have always been local flaws because Apple leaves some local exploits to keep jailbreaking viable.

    Of course, even with said flaws actual exploits exist pretty much only for Android.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Only locally, not remote by amicusNYCL · · Score: 1, Troll

      There have always been local flaws because Apple leaves some local exploits to keep jailbreaking viable.

      No, they don't. They patch the exploits that jailbreaks use as soon as they can. If Apple wanted "jailbreaking" to be "viable" then it would be a built-in feature, not a root hack. Of course, a published statement from Apple stating the contrary would go far to further your claim.

      Of course, even with said flaws actual exploits exist pretty much only for Android.

      Even though I realize that "SuperKendall" is synonymous with "unapologetic Apple fanboy", for some reason I still feel compelled to respond. I guess I'm bored.

      Pwn2Own 2010: iPhone 3GS compromised via bypassing code signing; Nexus One not compromised.
      Pwn2Own 2011: iPhone 4 compromised via malicious web page; Nexus S not compromised.

      "pretty much". "pretty much" only for Android. Is it only for Android, or is it "pretty much" only for Android? Because those two aren't the same thing. Care to throw out any more weasel words to make yourself feel secure in your purchase? You obviously don't, or you wouldn't have posted that.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
    2. Re:Only locally, not remote by Anonymous Coward · · Score: 0

      Strange that you didn't mention 2012 when both were hacked. Hmm...

    3. Re:Only locally, not remote by amicusNYCL · · Score: 2

      I looked at the pwn2own website for results from 2012, they only listed browsers. I assumed no mobile devices were included. I looked at this:

      http://pwn2own.zerodayinitiative.com/

      and this:

      http://pwn2own.zerodayinitiative.com/status.html

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
  31. Should be tagged "humor". by Anonymous Coward · · Score: 1

    You had me at "Apple's iOs has been known as a bastion of security for many years"...

  32. Is your daughter an international spy? by SuperKendall · · Score: 0

    my daughter has my iphone 3GS...(I had a new battery put in it and its good as new) Now, she won't be upgrading to ios7 either, because the 3GS isn't supported. So yeah, security fixes for ios6 would be pretty welcome.

    So since the "hack" involves have a small charger that's really an iOS development computer, and can attack only 100 devices before it runs out of open UUID's in the deve account they use - what makes you think your daughter's iPhone would be worth the degree of effort it takes to attack?

    There's no way that an iOS device worth attacking at this point is not at least on an iPhone 4 or higher.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:Is your daughter an international spy? by vux984 · · Score: 1

      So since the "hack" involves have a small charger that's really an iOS development computer, and can attack only 100 devices before it runs out of open UUID's in the deve account they use - what makes you think your daughter's iPhone would be worth the degree of effort it takes to attack?

      What would the effort be to back port the patch to ios6? There are millions 3GS phones out there still. I agree this particular hole is relatively low risk -- but all security fixes in general should be back ported. You do realize the 3GS was only discontinued less than a year ago right? Its not some long forgotten toy from antiquity. They were still selling them last July.

      There's no way that an iOS device worth attacking at this point is not at least on an iPhone 4 or higher.

      Right, because no one would ever be interested in hacking a 12 year old girls phone. :facepalm:

    2. Re:Is your daughter an international spy? by Anonymous Coward · · Score: 0

      "Right, because no one would ever be interested in hacking a 12 year old girls phone."

      Exactly. Your daughters iPhone is completely uninteresting.

    3. Re:Is your daughter an international spy? by Anonymous Coward · · Score: 0

      How dare you speak critically of Apple.

      The general thrust of what SuperKendall writes still stands: Apple are awesome. Even their iShit doesn't stink.

    4. Re:Is your daughter an international spy? by vux984 · · Score: 1

      Exactly. Your daughters iPhone is completely uninteresting

      I seem to recall there being a whole class of criminals who would love nothing better than to have access to a 12 year old girls phone, her photos, contact lists, friends lists, calendar...

  33. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Um, I plug both my iPhone and iPad into a USB plug thats built into a wall power socket.

    In fact ANYTHING that will supply 10W through a standard USB socket will charge an iPad/iPhone/iPod, USB-car chargers, the mains powered one which came with my panasonic camcorder, my power strip that has a USB outlet on it, laptops, desktop PCs, none of these built by Apple.

  34. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Yeah, because Apple chargers are just so hard to find. There's a time that talk like that made sense... a time when if you owned an LG X-12 there was a good chance that a LG R-25 wouldn't use the same charger but it's just not like that today. Both in my home and my office Apple connectors are just as common as MicroUSB. If anything it's the MicroUSB that comes off as the "special cable."

  35. Re:user's brain gets hacked, by greghodg · · Score: 1

    "You're charging it wrong."

  36. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 1

    You'll only get 150mA charging from a USB cable with no data lines. Anything higher from a computer requires negotiation (will get you up to 500mA), and from a wall-wart requires shorting the data pins.

  37. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Does your USB cable carry raw audio?
     
    I guess they don't do the same thing.

  38. If Snowden uses an iPhone... by wjcofkc · · Score: 1

    I would imagine our government would be more interested in acquiring a secretly swapping it with one like killed that lady in China, or swapping with any political enemies that use an iPhone.

    --
    Brought to you by Carl's Junior.
    1. Re:If Snowden uses an iPhone... by JaredOfEuropa · · Score: 1

      political enemies that use an iPhone.

      On Slashdot these often seem to be synonymous. (iPhone user here)

      --
      If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
  39. Re:The Internet of Things... by Anonymous Coward · · Score: 1, Insightful

    Anyone stupid enough to use a strangers "charger" deserves what they get, and its no ordinary charger, but a computer attached via usb cord.

  40. Re:It does use USB for charging, USB more dangerou by plover · · Score: 0

    Why can't Iphone / ipad have usb port for charging and not high priced apple changes

    The Apple chargers just supply a USB port power. The iOS devices can all plug into any USB port to charge...

    -1, wrong.

    From Ken Shirrif's blog:

    "The USB output also has specific resistances connected to the data pins to indicate to the iPhone how much current the charger can supply, through a proprietary Apple protocol.[10] An iPhone displays the message "Charging is not supported with this accessory" if the charger has the wrong resistances here. "

    [10] Apple indicates the charger type through a proprietary technique of resistances on the USB D+ and D- pins. For details on USB charging protocols, see my earlier references.

    [14] Ladyada reverse-engineered Apple chargers to determine how the voltages on the USB D+ and D- pins controls the charging current. Minty Boost: The mysteries of Apple device charging. Also of note is the picture of the internals of a official Apple iPhone 3Gs charger, which is somewhat more complex than the charger I disassembled, using two circuit boards.

    --
    John
  41. Re:The Internet of Things... by Anonymous Coward · · Score: 0

    Or just more desireable.....

  42. Re: The Internet of Things... by Anonymous Coward · · Score: 0

    iOS is worse than winblows as far as worms go.

  43. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    How many Android handsets come with USB debugging enabled by default?

    How many real world malware purveyors would go to such lengths as to modify an iPhone charger into a mini linux box, do a few weeks of coding and then leave the things around hoping for unsuspecting victims to pick them up and plug them into their iPhone? There has to be an easier way to hack somebody's phone than this.

  44. Re:Why can't Iphone / ipad have usb port for charg by Beardo+the+Bearded · · Score: 1

    My outlets at home provide all the current my device could hope for.

    --

    ---
    ECHELON is a government program to find words like bomb, jihad, plutonium, assassinate, and anarchy.
  45. Re:Why can't Iphone / ipad have usb port for charg by NatasRevol · · Score: 4, Informative

    A lot of iDevice users believe the fancy ports are better than standard USB ports when in fact they both do the same thing.

    Why are so many people so ignorant on this point?

    http://en.wikipedia.org/wiki/Dock_connector#30-pin

    It contains controls, audio and video, as well as data & charging like USB.

    --
    There are two types of people in the world: Those who crave closure
  46. Re:Why can't Iphone / ipad have usb port for charg by John+Bokma · · Score: 1

    Major advantage to me is that now I don't have to double check if I have the right side "up" of the connector when I connect my iPad to the charging cable. You can bitch a lot about Apple I think this is a step forward, especially for older people.

  47. Re:It does use USB for charging, USB more dangerou by Anonymous Coward · · Score: 0

    Funny. I've never seen that and I've charged with plenty of non-Apple chargers including using USB ports with non-Apple 30 pin and lightning connectors.
     
    Meh. More SlashFUD.

  48. Re:The Internet of Things... by the_other_chewey · · Score: 4, Informative

    Apple's iOs has been known as a bastion of security for many years

    Uh, what? The fuck it has.

    That had me chuckling as well.

    Remember when you could visit a website to "slide to jailbreak"
    from right inside the web browser?

  49. Re:The Internet of Things... by Anonymous Coward · · Score: 1

    Actually, the cash prize dwarfs the object prize, which eliminates any notions of going for a certain object because it is more "desirable."

    The Apple products are the easiest to crack and are usually pwnd in a matter of seconds.

  50. Bug? More like "security feature" by Neuroelectronic · · Score: 1

    I'm sure this is intentional. That's why they're not fixing it until next version, when they can implement a new backdoor that isn't so easy to find before onboarding the new clients (NSA). Same type of shit from Microsoft and Oracle delaying zero-days. "oh yeah we can fix this obtuse, barely exploitable and complex exploit in an emergency out of cycle release" "oh, but, no. this obvious out of bounds issue with a trivial satiny check fix with exploits in the wild that convenient make investigators jobs much easier can't be done until 6 months from now"

    yeah... ok.

    1. Re: Bug? More like "security feature" by Anonymous Coward · · Score: 0

      "satiny check"?

  51. Re:It does use USB for charging, USB more dangerou by Anonymous Coward · · Score: 0

    So many links, and just plain wrong.

    An iphone will charge just fine off of any USB port on any old PC.

    In fact, it has been this way since the ipods, which used the same connector. If I remember right, some ipods didn't even include a charger; you HAD to charge them off of USB unless you bought your own charger. Or maybe we just lost the charger; but the point is, charging over USB worked just fine.

  52. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Free charging stations at protest rallies would be an easy way for Feds to gather extended data on everyone present.

  53. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 5, Informative

    iOS uses signing too. The hack described here reads the phone's UID, signs it with an Apple dev key, and then pushes it to the phone. It requires communication with Apple servers and can be used on at most 100 devices before it's automatically disabled.

    It's a slightly different style of attack than would be used on Android phones, but in terms of public vulnerability it's not really a different threat level.

  54. Re:The Internet of Things... by Anonymous Coward · · Score: 0, Insightful

    Right... you bought an expensive phone which can be hacked in seconds, but its their fault for using a charger? Perhaps the dongle part is hidden from view and all you see is the cord? if someone wants to hack you they are not likely to put up a sign saying "malicious charging unit here". Typical apple fan response, its the users fault...

  55. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    On some computers. Others will happily provide 5V until the fuse/thermistor (if present) overheats.

  56. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Does the other end of apple's magically expensive cord plug into a USB port?

  57. Re:Why can't Iphone / ipad have usb port for charg by mjwx · · Score: 1

    Even with USB debugging enabled (which some handsets constantly nag to have it turned off), Android handsets use a public/private key system. If the charger tries to get access, the phone will ask if it should have full data rights to it.

    Of course, this means that if someone clicks OK, they are hosed, but it is better than just sticking an adapter on and doing dirty work without knowing the device's PIN or password.

    Not quite,

    If the device is in fastboot mode it'll let any device have it's way with its file system.

    But you need have put the device in fastboot mode, which means the user is an idiot or you've got physical access to the device. In which case on device security wont help one iota.

    --
    Calling someone a "hater" only means you can not rationally rebut their argument.
  58. Who do Haters insist on demonstrating ignorance? by SuperKendall · · Score: 1

    The Apple chargers CAN supply more power than the USB spec to Apple devices.

    But it's totally optional. You can charge ANY iOS device on ANY USB port, it will just take somewhat longer. You can plug ANY USB powered device into an Apple USB charger, and it will charge. It's USB, that's what it does.

    In just one post you manage to demonstrate complete ignorance as to the subject matter at hand, and unwillingness even to use Google for one second to prevent yourself from looking like a complete idiot.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
  59. Re:Why can't Iphone / ipad have usb port for charg by chowdahhead · · Score: 1

    This isn't accurate. Fastboot will only flash something that's signed by the manufacturer, unless the bootloader is unlocked, which won't matter anyway if the device is encrypted. Nexus devices are locked too, and unlocking the bootloader wipes all data, so you still won't get access to anything. ADB sideloading requires ADB to be enabled and the RSA fingerprint of the PC to be accepted.

  60. Re:The Internet of Things... by Anonymous Coward · · Score: 0

    Except for the fact the more non apple products are powned at those contests than apple products. Especially 2012 and 2013.

  61. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Not to mention since it tied to a developer account that account can be revoked at it will leave a "paper trail".

  62. Posting anonymous for obvious reasons... by Anonymous Coward · · Score: 1

    The charger is a mini linux machine what needs to use an apple developer account to dynamically add the devices UDID to the developer portal.
    It then signs the malicious app and installs it.
    It takes advantage of ad-hoc distribution and would require a new Apple developer account every 100 devices.

    The only real mastery of this hack is that it can be concealed to look like a charger due to the small footprint of the linux PC. Otherwise, I could do the same thing with physical access to the phone.

    Still, a fun wee hack and novel approach.

    It also requires a modified cable with at least some of the same electronics that are used for the factory burn-in through the dock connector. The hack either required some stellar reverse engineering, or it required access to an Apple engineer with clearance for the cable for developer fused devices, or it required a factory worker in China to sneak out a cable. My money would be on the China connection, since China tends to leak like a sieve, even in the factories used for Apple products.

    1. Re:Posting anonymous for obvious reasons... by blueg3 · · Score: 1

      What component of the hack actually required that?

      As I understand it (having been at the talk), all it does is grab the device UDID, pair with the device as if it was a copy of iTunes, sign and install a developer provisioning profile, and use that to install an application signed by the corresponding developer signing cert.

      Three of these (obtain UDID, pair with device, install application) are used all the time in the normal operation of syncing with iTunes. Installing a developer provisioning profile is used all the time by iOS application developers.

    2. Re:Posting anonymous for obvious reasons... by Anonymous Coward · · Score: 0

      What component of the hack actually required that?

      As I understand it (having been at the talk), all it does is grab the device UDID, pair with the device as if it was a copy of iTunes, sign and install a developer provisioning profile, and use that to install an application signed by the corresponding developer signing cert.

      Three of these (obtain UDID, pair with device, install application) are used all the time in the normal operation of syncing with iTunes. Installing a developer provisioning profile is used all the time by iOS application developers.

      To get the UDID for the device, you either have to talk to a daemon on the device because you have permission to do so, because you are running a copy of iTunes with the developer keys loaded, and you've authorized access to the UDID through the back end iTunes as one of your accounts authorized devices, or you have to override it with a Purple cable. See here for details:

      http://www.innerfence.com/howto/find-iphone-unique-device-identifier-udid

      Notice the copy/paste method assumes that the device is already paired with iTunes. An alternative to this method would involve jailbreaking the iPhone instead, or intentionally loading the email App on and/or typing the information in from the iPhone UI display itself, neither of which demonstrate the transparency needed for the hack to be impressive.

  63. Re:Why can't Iphone / ipad have usb port for charg by mjwx · · Score: 1

    This isn't accurate. Fastboot will only flash something that's signed by the manufacturer, unless the bootloader is unlocked, which won't matter anyway if the device is encrypted. Nexus devices are locked too, and unlocking the bootloader wipes all data, so you still won't get access to anything. ADB sideloading requires ADB to be enabled and the RSA fingerprint of the PC to be accepted.

    I wasn't talking about flashing anything, simply reading, copying to and modifying files on the file system. Fastboot enables the ADB bridge.

    If you've gotten into fastboot, you've probably bypassed most if not all the security measures (most importantly, the physical security).

    --
    Calling someone a "hater" only means you can not rationally rebut their argument.
  64. Re: Why can't Iphone / ipad have usb port for char by ceoyoyo · · Score: 1

    The cord that has audio connectors on the other end doesn't. Just because you've never plugged anything but a USB cable into your iPhone doesn't mean nobody else has.

  65. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    none..oh wait was that a rhetorical question?

  66. Re: Why can't Iphone / ipad have usb port for char by Anonymous Coward · · Score: 0

    No, all USB hosts provided 5v until the PTC trips. Devices are not supposed to draw more than 150ma unless they get clearance from the USB bus or the data lines are jumpered.

  67. The Real POwn by SuperKendall · · Score: 2, Informative

    Pwn2Own 2010: iPhone 3GS compromised via bypassing code signing; Nexus One not compromised.

    Every year Android has existed: 99% of viruses on Android.

    Reality totally contradicts the picture you are trying to point. Android far more secure: Odd then it has ALL of the viruses/trojans/malware. Apple disliking jailbreaking: odd then that jailbreaks come out with great regularity after every new OS or device release (but mostly tethered) and Apple hires jailbreak developers to work on core systems sometimes...

    Your hatred is blinding you to reality.

    --
    "There is more worth loving than we have strength to love." - Brian Jay Stanley
    1. Re:The Real POwn by amicusNYCL · · Score: 1

      Every year Android has existed: 99% of viruses on Android

      Don't move the goalposts, are you talking about root exploits or viruses? I'm not talking about viruses, and you weren't either. Apparently, now you are.

      Reality totally contradicts the picture you are trying to point. Android far more secure

      That's not my point. YOUR point was that "exploits exist pretty much only for Android", and I was refuting that my pointing out exploits for iOS. I said nothing about Android's security. I know about Android's security, I'm not trying to hold it up as a bastion of security like you're doing for iOS, I'm trying to contradict your demonstrably false statements about iOS. Again, stop moving the damn goalposts.

      Apple disliking jailbreaking: odd then that jailbreaks come out with great regularity after every new OS or device release

      Yeah, it's pretty odd that there are root exploits in every iOS release, all right. I agree with you there. Apple obviously doesn't want that. Again, if you disagree with that, the way to prove me wrong is to point to a published statement from Apple stating the contrary. You can't do that though, because that statement doesn't exist, because Apple does not approve of jailbreaking nor do they insert exploits specifically to support it.

      Apple hires jailbreak developers to work on core systems sometimes

      "Sometimes"? Enough with the weasel words. Put up or shut up, I want proof not your opinion. A talented developer is a talented developer, if someone working on jailbreaks is talented then I'm sure Apple and several other companies would want to hire them. You seem to be implying that Apple is hiring them to add exploits to iOS, which is just a ridiculously stupid claim. Again, if you disagree, show me proof.

      Your hatred is blinding you to reality.

      That's rich coming from you, it really is. I don't hate Apple, I hate shills like you.

      --
      "Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
  68. Re:Apple Shilling by LynnwoodRooster · · Score: 1

    Cereal boxes are at least useful...

    --
    Browsing at +1 - no ACs, I ignore their posts. So refreshing!
  69. This helps Apple by Frankie70 · · Score: 0

    Do not buy anything except Steve Jobs' blessed chargers from Steve Jobs' blessed stores from Steve Jobs' bless salesgeniuses.

  70. It's a smart hack, thats all by Camael · · Score: 4, Insightful

    Anyone stupid enough to use a strangers "charger" deserves what they get, and its no ordinary charger, but a computer attached via usb cord.

    Come on, lets get a sense of perspective instead of going into fanboyism (or anti for that matter).

    Before today I had absolutely no idea a microcomputer could be made to look like a charger, or that the charging port on iPhones could be used to hack iOS. If you read TFA, the way they did it is pretty deceptive and ingenious.

    The charger could be made to look like a typical Apple charger, meaning those looking to infect iPhones and iPads could leave them lying around in public charging zones to trick unsuspecting members of the public.

    In the demonstration in Las Vegas, the researchers used the Facebook app as an example of an software that could be compromised. Once the charger is plugged in and the user inputs their PIN code, the charger silently and invisibly removes the target app, in this case the official Facebook app. It then replaces it - in exactly the same position on your iPhone/iPad homescreen - with what looks like a perfect replacement. In actual fact this is malware and once you launch it, your phone/tablet has been compromised.

    Its fair to say that most people have a blind spot insofar as power ports are concerned, we normally don't think of it as a point of entry and this is the social engineering trick this hack takes advantage of . In fact, I think that prior to iPod/iPhones, no device used their power point to double up as a data connector. Pre-iphone, I remember swapping and borrowing Nokia/Sony etc. phone chargers from friends/strangers with no repercussions whatsoever.

    It is very insulting and unfair to call people who would use a stranger's charger 'stupid' -not everyone is a techie or keeps updated with technology news. Which is probably why you posted as AC instead of under your own name =)
     

  71. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    But that's what makes IOS so good. It doesn't ask you dumb questions like "do you want your phone rooted via this USB port" - it just goes ahead and does it. It's a bit like the many volume levels in IOS - you can only set ONE of them, so if ANY of the other volumes fucks up, you're toast - as happened to me. It took me a VERY long time to recover my volume (other than the factory reset suggested by Apple).

  72. Dupe by Plumpaquatsch · · Score: 1

    http://it.slashdot.org/story/13/06/03/0312208/researchers-infect-ios-devices-with-malware-via-malicious-charger - "At the upcoming Black Hat security conference in late July, three researchers at the Georgia Institute of Technology plan to show off a proof-of-concept charger..."

    --
    Of course news about a fake are Fake News.
  73. We warned you. by Animats · · Score: 1

    Back in 2009, I wrote on Slashdot

    Yes, I was in an airport recently, and there were power outlets with both AC and USB. The future is here.
    Yes, but how do you know it only provides power? It might also read or write whatever is plugged into it, install malware, steal your info, or whatever.

    We warned you. You didn't listen. Now suffer. Downside

  74. IOS 7/6 by Anonymous Coward · · Score: 0

    Are you kiddin' I'm still using iOS 5. "Facebook integration" deterred me from upgrading-- I do use Facebook, but no way I want it integrated. Facebook sandboxing, now for that I'll upgrade. When I buy a new IOS device, the first thing I'll have to do is jailbreak it (have had no need to so far) just so I can un-integrate Facebook. Perhaps by downgrading the app to the oldmone I'm running now-- pre video ads...

  75. Pot calling kettle much? by Camael · · Score: 1

    Please, read TFA you linked to.

    According to the recently published Kaspersky Security Bulletin 2012, 99% of newly discovered mobile malicious programs target the Android platform.

    99% of newly discovered malware is not the same as 99% of viruses. Stop spinning.

    Further, having a larger number of malware directed at a platform does not mean that particular platform is less secure. Malware makers will benefit the most by having large infection pools, and will thus often target the most popular platform, which right now is Android.

    You should also note, also in TFA you linked :-

    One of the most unusual examples of mobile malware in 2012 was the "Find and Call" application that managed to sneak into the Google Play store as well as Apple’s application store.

    Dare I say, both platforms pwned then? The only truth is that neither platform is totally secure, and that security depends on the manner of use; for example, if you jailbreak or root your phone, you are more exposed. Trying to spin it either way is an exercise in stupidity.

  76. Re:Why can't Iphone / ipad have usb port for charg by ljw1004 · · Score: 1, Insightful

    Are you distinguishing that from all the devices that do audio, video and controls over USB?

  77. A charger that only takes 60 seconds?!? by Anonymous Coward · · Score: 0

    Where can I get one!?!?

  78. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Yes he is. Because there's no such thing as a USB device that carries analogue audio or video. Or even real digital audio or video (such as S/PDIF or DVI, not some streamed computer format), for that matter.

  79. Re:The Internet of Things... by Anonymous Coward · · Score: 0

    You're right, there haven't been several month periods when no one could jail brake their device because no one could find a single root exploit – even one that could be exploited with physical access. Oh wait, there have.

  80. "Nifty" that they're fixing it? by wonkey_monkey · · Score: 2

    [I]t's nifty that Apple is addressing the issue in iOS 7.

    How is that "nifty"? It's the least they should do. It's like Chris Rock's thing about all those parents who go round proudly proclaiming that "I take care of my kids!" You're supposed to take care of your kids!

    --
    systemd is Roko's Basilisk.
  81. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Almost none, how many come with a single root exploit somewhere in their entire codebase? Probably all of them.

  82. Re:The Internet of Things... by Anonymous Coward · · Score: 0

    What about the myriad devices with iPhone specific docks? Would you trust using someone else's speakers with your iPhone? I'm willing to bet most iPhone owners wouldn't give it a second thought.

  83. Re:Why can't Iphone / ipad have usb port for charg by parkinglot777 · · Score: 1

    Of course, this means that if someone clicks OK, they are hosed, but it is better than just sticking an adapter on and doing dirty work without knowing the device's PIN or password.

    Hmm... So how is that different from the Apple charger case if a user manually authorizes the process? Didn't you read the TFA or even the summary?

    Once the charger is plugged in and the user inputs their PIN code, ...

    You see, it means that an iPhone user has to input their PIN or "authorize" the access, which is similar to clicks "OK" as you mentioned. From here, I see no difference between the USB debugging feature enabled and charger...

  84. Motorola StarTac combined them by Anonymous Coward · · Score: 0

    In fact, I think that prior to iPod/iPhones, no device used their power point to double up as a data connector.

    The Motorola StarTac had a connector that simultaneously charged it from a USB port while also establishing a data connection.

    Here's the thing: for both the iPod/iphone 30-pin connector and the old Motorola StarTac connector it was entirely up to the wiring in the cable whether it provided only power or both power and data, but iPod users pushed cable manufacturers to only offer cables that do both. For the StarTac, users didn't care so much and manufacturers offered both power-only cables and power+data cables. Carrying a 30-pin cable that only had wiring for the power pins could immunify you from the hack, but users don't want to give up convenience.

    For the lightning connectors, Apple offers multiple security chips for license and I believe the cheapest only supports charging but nobody has licensed it for a cable (not even manufacturers of car chargers) again because users negatively view cables that don't support both power and data.

    Frankly I think a niche manufacturer missed the boat on a marketing opportunity here. Many installations where classified work is done prohibit you from using your work computer to charge your phone because they're worried about data leakage. If someone offered a cable using Apple's power-only chip they might be able to get those workplaces to buy such a cable for their business Apple devices.

  85. Re:The Internet of Things... by Anonymous Coward · · Score: 0

    Because there are more non-Apple products than Apple products?

    s/powned/pwned/

  86. Re:Why can't Iphone / ipad have usb port for charg by Anonymous Coward · · Score: 0

    Yes, yes it does. WTF USB cables have you been using?

  87. Re:Who do Haters insist on demonstrating ignorance by Anonymous Coward · · Score: 0

    One of you comes off as an idiot. Hint: It's not plover.

  88. Can we just have a voltage-wire-only charger? by davidwr · · Score: 1

    If you cut all the wires in your charging cable except power and ground, will the device still charge?

    If so, transparent "USB extenders" that only have power and ground wires would let anyone charge anywhere without data risk (there would still be the risk of malicious over-voltage, but that's a different risk).

    If not, then future devices that charge over USB or other data+power cable should be built to charge with a "power-only, all other pins disconnected" cable.

    --
    Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
  89. Re:Why can't Iphone / ipad have usb port for charg by thoromyr · · Score: 2

    it also requires the user to unlock the device.

  90. Public charging ports by phorm · · Score: 1

    Especially when a lot of places (airports, even planes etc) now provide USB ports for charging of mobile devices.

  91. Re:Why can't Iphone / ipad have usb port for charg by NatasRevol · · Score: 1

    Can you point ONE out?

    --
    There are two types of people in the world: Those who crave closure
  92. Re:The Internet of Things... by lipanitech · · Score: 1

    You can tell Apple's under new management recently. Apple used to never admit to security issues and flaws under the Steve Jobs flag. Apple has always been the holy grail of hackers.

  93. Not Just iPhones by Anonymous Coward · · Score: 0

    On a train, laptop plugged into an outlet someone approaches you and says, "I have an important call to make and my phone battery is almost dead, can I plug it into your laptop's USB port."

  94. Re:Why can't Iphone / ipad have usb port for charg by david_thornley · · Score: 1

    Assuming the user keeps the device locked normally. It's a balance of convenience and security, and this revelation has changed the balance.

    --
    "When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes
  95. appleOS secure??? by Anonymous Coward · · Score: 0

    hundreds of posts and im not seeing anyone drop the word so here it goes

    ASPEN

    local and remote - saw someone else use it just the other day, not secure in the least really.

  96. Re:Why can't Iphone / ipad have usb port for charg by NatasRevol · · Score: 1

    So, you can't point ONE out that can do all three.

    Also the video one is a custom chip so not JUST over USB.

    Also, the audio one is a custom chip so not JUST over USB.

    Also the controls one is a custom chip AND custom software so not JUST over USB.

    Thanks for perfectly making my point.

    --
    There are two types of people in the world: Those who crave closure
  97. Re:Why can't Iphone / ipad have usb port for charg by ljw1004 · · Score: 1

    ??? Of course there's custom hardware at the other end. The iphone cable requires custom hardware that (1) has the right sized port, (2) has the circuitry that does something with the signal it gets (except in the case of audio).

    The point stands. Video, audio and control can certainly be done over USB. There's no *NEED* for the iphone cable.

  98. Re:Why can't Iphone / ipad have usb port for charg by NatasRevol · · Score: 1

    LOL. We need custom hardware. Apple doesn't need custom hardware!

    Or something.

    Let me know when you get those things over just a USB cable *without custom hardware*. That was the original argument.

    --
    There are two types of people in the world: Those who crave closure