Slashdot Mirror
Exploit that Caused iPhones To Repeatedly Dial 911 Reveals Grave Cybersecurity Threat, Say Experts (9to5mac.com)
Ben Lovejoy, writing for 9to5Mac: We reported back in October on an iOS exploit that caused iPhones to repeatedly dial 911 without user intervention. It was said then that the volume of calls meant one 911 center was in 'immediate danger' of losing service, while two other centers had been at risk -- but a full investigation has now concluded that the incident was much more serious than it appeared at the time. It was initially thought that a few hundred calls were generated in a short time, but investigators now believe that one tweeted link that activated the exploit was clicked on 117,502 times, each click triggering a 911 call. The WSJ reports that law-enforcement officials and 911 experts fear that a targeted attack using the same technique could prove devastating. Of the 6,500 911 call centers nationwide, just 420 are believed to have implemented a cybersecurity program designed to protect them from this kind of attack.
How does someone "accidentally" release something that will repeatedly call 911 on thousands and thousands of phones? Sounds like the creator is full of bullshit or stupid beyond comprehension.
and since most IOS users are on the latest version how is this still a problem?
One wonders if this was coordinated with a specific crime or if it was just a demonstration and they are selling to the highest bidder?
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
all in WAshington state and Colorado, I assume
This is not an exploit. It is an app that asks for the user to give it permission to make phone calls, which the user grants. Then the app calls 911.
There is nothing about iOS that is "exploited" to make this happen. The only thing that is exploited is user stupidity, which should come as no surprise given that education is the least important priority in the US.
What if christians or atheists did? After all they do kill more Americans than the muslims.
Imagine a robo-call-DDOS attack on certain lawmakers' phones during a crucial debate, denying those lawmakers input from consituents?
Imagine an attack on a company, either to force them to spend money they wouldn't have to spend, to embarrass them, or to distract them from doing things that would compete with another company in which you ("you" being a corrupt person, company, or government) has an interest in.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
It's true that they inherited a good security design from BSD, but they did some of their own thinking and it was one example of where the engineers and architects actually convinced Steve Jobs he was wrong - having a protected Applications folder, and requiring privilege escalation to install software. He thought they were nuts at the time, but in an interview much later he recounted how Avie Tevanian convinced him that it was necessary, and that Jobs was immensely thankful that he did.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
I had the same problem while trying to call in a wreck on California's SR 17. I gave up trying to call 911 when a volunteer firefighter happened to come upon the scene and after verifying that everybody was okay, called it in on his radio. If you can't rely on critical safety systems to actually work in a real emergency, then what's the point of even having them? From an outsider's perspective, our 911 system appears to be a train wreck and should probably be scrapped outright and replaced with something entirely different.
Check out my sci-fi/humor trilogy at PatriotsBooks.
Just block all iphone based called from the 911 system permanently. In fact, block all AT&T customers too. They're not worth the resources.
(This post is a joke btw, just in case you're an idiot)
just 420 are believed to have implemented a cybersecurity program designed to protect them from this kind of attack
How can they protect against a DDoS? I assume the protection must let legitimate call pass through, but how can they be recognized?
Run an install of a PKG without putting in a password, or run something that you just downloaded from the internet without being prompted about it (unless you specifically disabled that check, in which case you deserve to be exploited.)
Hint: it won't let you.
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.