Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Two Unpatched Flaws Show Up In Apple iOS

samzenpus posted more than 4 years ago | from the rotten-apple dept.

Security 171

Trailrunner7 writes "The technique that the Jailbreakme.com Web site is using to bypass the iPhone's security mechanisms and enable users to run unapproved apps on their phones involves exploiting two separate vulnerabilities. One of the vulnerabilities is a memory-corruption flaw that affects the way that Apple's mobile devices, including the iPad and iPod Touch, display PDFs. The second weakness is a problem in the Apple iOS kernel that gives an attacker higher privileges once his code is on a targeted device, enabling him to break out of the iOS sandbox. The combination of the two vulnerabilities — both of which are unpatched at the moment — gives an attacker the ability to run remote code on the device and evade the security protections on the iPhone, iPad or iPod Touch. The technique became public earlier this week when the Jailbreakme.com site began hosting a set of specially crafted PDF files designed to help users jailbreak their Apple devices and load apps other than the ones approved by Apple and offered in its official App Store."

cancel ×

171 comments

Sorry! There are no comments related to the filter you selected.

fuck yea. (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#33145424)

Apple and apple's fans suck, stupid elitist morons.

Lol apple (-1, Troll)

Anonymous Coward | more than 4 years ago | (#33145432)

But I thought OSX was secure.

Re:Lol apple (2, Interesting)

mini me (132455) | more than 4 years ago | (#33145494)

More secure does not equal completely secure.

Though you do bring up an interesting point. iOS is the biggest mobile operating system player right now, and even with that large market share, so far nobody has turned all of those iPhones into a botnet. If Windows had the same bug, we would have millions of maliciously compromised systems by now. What gives?

Re:Lol apple (3, Insightful)

pclminion (145572) | more than 4 years ago | (#33145506)

How do you know millions of phones aren't already compromised? They could just be sitting there quietly, waiting for the dust to settle a bit.

Do we need antivirus/antimalware on smart phones now? Welcome to the 21st century.

Re:Lol apple (5, Insightful)

tacarat (696339) | more than 4 years ago | (#33145530)

I remember my old brick of a cell phone back in the 90s. No published exploits yet. Sometimes simpler is better...

Re:Lol apple (1)

icebraining (1313345) | more than 4 years ago | (#33145654)

Yes, it has, it can be tricked into using a rogue cell [slashdot.org] .

Re:Lol apple (2, Informative)

MichaelSmith (789609) | more than 4 years ago | (#33145768)

Somebody could rewrire the phone lines to my house too, but I don't count that as a vulnerability in the simple electronics in my land line phones.

Re:Lol apple (2)

dotgain (630123) | more than 4 years ago | (#33146390)

I realise it's academic - but why not?

Re:Lol apple (0)

Anonymous Coward | more than 4 years ago | (#33146514)

If you don't consider that a vulnerability, you know nothing about security.

Re:Lol apple (1)

MichaelSmith (789609) | more than 4 years ago | (#33146626)

Of course its a vulnerability, just not with the phone. The vulnerability is in the infrastructure.

Re:Lol apple (2, Insightful)

icebraining (1313345) | more than 4 years ago | (#33146700)

Of course it's with your phone:

Although the GSM specifications say that a phone should pop up a warning when it connects to a station that does not have encryption, SIM cards disable that setting so that alerts are not displayed. Even though the GSM spec requires it, this is a deliberate choice of the cell phone makers, Paget said."

Your phone should warn you and it doesn't. It's a vulnerability in your phone.

Re:Lol apple (4, Informative)

Some.Net(Guy) (1733146) | more than 4 years ago | (#33145520)

iOS is the biggest mobile operating system player right now

Yep, it sure is. I mean, if you don't count Android [trendsupdates.com]

Re:Lol apple (3, Insightful)

pushing-robot (1037830) | more than 4 years ago | (#33145588)

BlackBerry? Symbian?

Re:Lol apple (4, Insightful)

mini me (132455) | more than 4 years ago | (#33145598)

I am not sure why people keep quoting that article when it comes to OS share. Apple sells more iPod touches [theappleblog.com] and iPads [ngonlinenews.com] than iPhones. Android barely squeaks past just iPhone and only in the US market. I do expect that one day Android will dominate the market, but it has a long way to go.

He said operating systems, not devices (3, Interesting)

SuperKendall (25149) | more than 4 years ago | (#33145726)

iOS is the biggest mobile operating system player right now
Yep, it sure is. I mean, if you don't count Android

Count Android all you like, if you count every Android device sold to date it would not equal the number [cnn.com] of iPhone and iPod Touch units sold.

The Touch (and iPad) all run the same mobile iOS the phones do.

Note that link was from back in 2009...

Re:He said operating systems, not devices (3, Informative)

somenickname (1270442) | more than 4 years ago | (#33145812)

Count Android all you like, if you count every Android device sold to date it would not equal the number [cnn.com] of iPhone and iPod Touch units sold.

The Touch (and iPad) all run the same mobile iOS the phones do.

Note that link was from back in 2009...

Android and iOS combined don't even come close to Symbian.

True but pointless (2)

SuperKendall (25149) | more than 4 years ago | (#33145894)

Android and iOS combined don't even come close to Symbian.

Since it's not a modern mobile OS on just about all those phones the point is irrelevant. Like saying there are not as many Android devices as grains of sand on all the beaches in the world.

Re:True but pointless (1)

somenickname (1270442) | more than 4 years ago | (#33146028)

Android and iOS combined don't even come close to Symbian.

Since it's not a modern mobile OS on just about all those phones the point is irrelevant. Like saying there are not as many Android devices as grains of sand on all the beaches in the world.

To use a car analogy, it's more like saying that the number of people that own a Lexus or BMW is dwarfed by the number of people that own a Honda. While the Honda owners may be more concerned with reliably getting from point A to point B, and the Lexus/BMW owners may be more concerned with comfort, status or performance, in the end, they are all cars and perform the same basic service.

Car Analogy Back from the Shop (1)

SuperKendall (25149) | more than 4 years ago | (#33146166)

To use a car analogy, it's more like saying that the number of people that own a Lexus or BMW is dwarfed by the number of people that own a bicycle.

Fixed it for you, and far closer to the case at hand (at least with regards to Symbian).

Your analogy was actually not too bad if we had been talking about Blackberry, except you would have had to add in the fact about roads going forward only being made for Lexux/BMW and Hondas could not use them. How long after you can't use new roads would you be forced to buy some other car, no matter how well it ran?

Re:He said operating systems, not devices (0)

Anonymous Coward | more than 4 years ago | (#33146778)

But if you count Ipads, then you have to count Windows Laptops too. In that case, iOS is not anywhere near the largest mobile OS...

Re:Lol apple (5, Informative)

h4rr4r (612664) | more than 4 years ago | (#33145692)

iOS is not the biggerst mobile operating system in any way shape or form. RIM has far more devices in North America and Nokia rules the rest of the world.

Re:Lol apple (-1, Troll)

mini me (132455) | more than 4 years ago | (#33145814)

Wikipedia cites some OS market share numbers as of June: http://en.wikipedia.org/wiki/Usage_share_of_operating_systems [wikipedia.org]

Note that these numbers included desktop operating systems:

iOS: 1.12%
Blackberry: 0.35%
Android: 0.23%
Symbian: 0.16%

I realize the numbers are not perfect, but they at least give some indication where iOS stands in the mobile OS wars. I do not doubt that there are more BB and Nokia phones than iPhones out there, but the iPhone only accounts for, according to some reports, about one third of all iOS sales.

Re:Lol apple (4, Informative)

somenickname (1270442) | more than 4 years ago | (#33145918)

That page doesn't say that at all. You've quoted numbers (and even incorrectly inflated the iOS numbers by instead quote the linux desktop numbers) about browser strings. If you scroll down, you will see a VERY different picture of the marketplace for mobile devices (including iPhone, iPad and iPod):

From Gartner:

Symbian: 44.3%
Blackberry: 19.4%
iOS: 15.4%
Windows Mobile: 6.8%
Android: 9.6%
Linux: 3.7%
Other: 0.7%

Even allowing for a hefty margin of error, compared to Symbian, iOS is a very distant third.

Re:Lol apple (3, Informative)

mini me (132455) | more than 4 years ago | (#33146140)

The Gatner article you are referring to clearly states that those marketshare numbers are for cell phones. The majority of iOS devices are not cell phones at all.

Re:Lol apple (2, Informative)

Anonymous Coward | more than 4 years ago | (#33146178)

Those stats are just 1Q2010 sales, which may not be indicative of the total market share of phones currently in use. It's still a much better statistic than the one based on User-Agent strings though. With phones being replaced on average every 2 years though, one quarter worth of sales is an okay indicator, although Blackberry hasn't released too many phones recently.

The ComScore list appears to be better although they don't really say what their methodology is. They don't include Nokia in their list of smartphones and only have stats on US subscribers though...

(May 2010)
RIM 41.7%
Apple 24.4%
Microsoft 13.2%
Google 13.0%
Palm 4.8%

Re:Lol apple (1)

ScotterMonk (1864600) | more than 4 years ago | (#33146138)

This article, admittedly using different measurement, says Android is now #1: http://www.boygeniusreport.com/2010/08/04/npd-group-android-top-selling-smartphone-platform-in-u-s-for-q2/ [boygeniusreport.com] I think it is funny how we can focus on a certain metric to get whatever results we want :)

Re:Lol apple (2, Interesting)

Draek (916851) | more than 4 years ago | (#33145928)

Because iPhones are lacking in both performance and net access compared to even a low-end Windows machine, so they're mostly useless for botnets.

And you really need a reality check if you think iOS is anywhere *near* the biggest mobile OS.

Re:Lol apple (1)

mini me (132455) | more than 4 years ago | (#33146080)

And you really need a reality check if you think iOS is anywhere *near* the biggest mobile OS.

Who is a bigger player? It is true that Symbian outsells the iPhone more than two to one, but the iPhone is outsold by both the iPod touch and iPad. Some reports claim iOS has twice as many installs compared to the nearest competition.

Re:Lol apple (0)

Anonymous Coward | more than 4 years ago | (#33146312)

Get your facts straight - Symbian runs on many more handsets than iphone. Its not even a contest, not even close.

Re:Lol apple (2, Insightful)

PopeRatzo (965947) | more than 4 years ago | (#33146394)

More secure does not equal completely secure.

Another way to put it might be: "If it's not completely secure, it's not secure at all".

Re:Lol apple (3, Informative)

exomondo (1725132) | more than 4 years ago | (#33146690)

iOS is the biggest mobile operating system player right now

bullshit! [cnet.com]

Flaw? (0, Troll)

nurb432 (527695) | more than 4 years ago | (#33145478)

Or feature?

Since its allowed many of us to jailbreak our devices id say its a feature. But one they will want to patch to prevent it. To bad if we don't, we are vulnerable to legitimate attacks.

Now that the feds have officially said we can do this with out any legal repercussions ( well, duh...), why cant Apple just open it up with a disclaimer " yes, here is the unlock code, but if you use it, you void your warranty " then track who uses their code ( a unique key per device ). That way users can have a choice, without relying on bugs.

Re:Flaw? (2, Insightful)

strayant (789108) | more than 4 years ago | (#33145516)

I'd say both, and wonder, is their code open to scrutiny? I'd love to see someone verify and certify that there's nothing malicious with their code. One can argue, however, that any other site could use this in a harmful manner. This is a *real* concern. So while the jailbreak is nice, what isn't so nice?

Re:Flaw? (2, Insightful)

maxume (22995) | more than 4 years ago | (#33145570)

The 'remote' part of the exploit sort of shits all over the 'feature' argument.

Re:Flaw? (2, Insightful)

Anonymous Coward | more than 4 years ago | (#33145604)

The problem is, it doesn't just allow you to jailbreak your phone. It allows anyone who can get you to view a pdf in the browser to own your phone -- that makes it a flaw, most definitely.

Re:Flaw? (1)

strayant (789108) | more than 4 years ago | (#33145740)

well, the jailbreakme.com site doesn't exactly let you know that *it* is showing you a PDF... so one could argue that it wouldn't take much to do the same in a destructive way. I'm thinking even of things like hacked sites with a little browser agent detection could seem innocent to most users... Anyone want a cheap botnet? So (1) when will this be patched, and (2) how many people will not patch.

Re:Flaw? (2, Funny)

somenickname (1270442) | more than 4 years ago | (#33145716)

This is a feature in the same way the antenna problem is: "Well, at least I get a free bumper out of it!"

Re:Flaw? (1)

dakameleon (1126377) | more than 4 years ago | (#33146108)

Because of jailbreak apps like Installous, and MyWi, and My3G. The first lets you pirate App Store apps, violating terms and screwing Apple & the developers of the Apps. MyWi and My3G piss AT&T and the other carriers around the world off because they let you use a service provided in a way they didn't intend you to use.

I'd suspect even Google would make more effort to lock down Android if stuff like Installous was floating around there (is it? I have no idea).

Re:Flaw? (2, Informative)

Mr2001 (90979) | more than 4 years ago | (#33146296)

I'd suspect even Google would make more effort to lock down Android if stuff like Installous was floating around there (is it? I have no idea).

You don't need anything like Installous on Android, because Android doesn't limit where you can install apps from. Once you check the "Allow installation of non-Market applications" option, you can just point the browser at a link to a .apk file.

Google is addressing paid-app piracy, but not by locking down the OS. Instead, they're letting apps check with Google's servers to verify that the app has been purchased by the person who's running it.

Re:Flaw? (2, Insightful)

squidinkcalligraphy (558677) | more than 4 years ago | (#33146288)

Certain a feature, if by feature you mean a remotely exploitable root vulnerability. Yes, definitely a feature. For crackers.

For the rest of us it's a pretty critical flaw, namely one that can 0wn yr ph0ne by visiting a malicious website.

Re:Flaw? (-1, Flamebait)

nonguru (1777998) | more than 4 years ago | (#33146676)

I'd pay for that app to break the walled garden.

Rather unlikely scenario required (-1)

Meshach (578918) | more than 4 years ago | (#33145510)

From the actual article [threatpost.com] (linked from the FA):

In order for the exploit to work and jailbreak one of the devices, it first has to get control of the mobile browser on the device. The next step would be to somehow circumvent DEP (Data Execution Prevention), the memory protection on the browser. The exploit then needs to find a way to break out of the iPhone's sandbox environment and get root privileges on the phone. And finally, it would need to turn off the code-signing functionality that Apple uses to enforce its rules on official apps.

Quite a lot of things need to line up for this to occur. Not that it shouldn't be fixed but to make to big a deal out of this seems to be an overkill or "chicken-little-syndrome".

Re:Rather unlikely scenario required (5, Insightful)

Spy Hunter (317220) | more than 4 years ago | (#33145532)

Um, the fact that jailbreakme.com works is proof that all those things are lining up perfectly. This is a real working exploit.

Falsely implied security (5, Insightful)

mrsteveman1 (1010381) | more than 4 years ago | (#33145542)

Back when Apple was trying to convince the public to accept this locked down app store model, one of the justifications was malware protection, specifically Jobs himself cited bluetooth worms. But the more these things start to look like and function like a general computer, the most likely attack vector is through websites just like on the desktop. The only other attack vector that Apple stops with this model is the fake screensavers, but apparently they aren't so good at catching unwanted code in the app store either, i believe there was a personal information theft app a few months back and just a few weeks ago there was a covert tethering app.

So i have to ask, if a website can line up a few exploits like this and compromise the entire device to the level needed to actually break the chain of trust Apple has created, what is the point of all this shit? Just so Apple can control their OS environment like a dictator?

didn't you just argue FOR the app store? (5, Insightful)

SuperKendall (25149) | more than 4 years ago | (#33145772)

But the more these things start to look like and function like a general computer, the most likely attack vector is through websites just like on the desktop

You just made the argument for why users should only use applications vetted from a store instead of the general web.

Happily the iPhone actually doesn't impose any restrictions on web use.

I just thought it was odd you were trying to argue against the security benefits of a closed app store using a bug in a totally open browser model.

The point of the app store would then be that the more applications users used, the less exposed they would be to web bugs. We know attackers inject exploits into popular websites all the time.

You missed his point... (1, Insightful)

Anonymous Coward | more than 4 years ago | (#33145818)

Apple pretends controlling the app store is enough to prevent malicious code, while this exploit shows that you have to also consider malicious data which injects code via existing "vetted" apps with data handling bugs (since proving app safety during vetting is far from a solved problem). The iPhone continues to become a general purpose computer as long as vetted apps do more and more complex things with data that is obtained from external sources.

I await the audible or visual hack that gets a malicious pattern in through the microphone or camera, and then triggers bugs in the apps that try to do clever things with sound, image, or video!

Re:You missed his point... (2, Interesting)

SuperKendall (25149) | more than 4 years ago | (#33145944)

while this exploit shows that you have to also consider malicious data which injects code via existing "vetted" apps

That implies if an app store app had a security issue it would be an issue beyond that application. That is generally not the case since the apps are all well sandboxed and cannot affect the system. Messing with an approved app via some flaw would usually get you nothing but a corrupted app. You can't even modify the app binary from the app itself...

I'm not even sure breaking an app would be able to get you to the same system privilege exploit break Safari is able to reach, since Safari is a system app that possibly has slightly more leeway in access to the system.

I await the audible or visual hack that gets a malicious pattern in through the microphone or camera, and then triggers bugs in the apps that try to do clever things with sound, image, or video!

I've read about that concept before and it's a cool thought experiment, but in reality I don;t think that's a practical line of attack since the full range of possible data from those forms of input is so well understood by things processing it and so limited in scope. Anything going in through the camera is going to have pixels with RGB values ranging from 0 to 255 in an array of pixels at a specific size, there's just no input you could give that would break anything. Basically the A/D converters are acting as a kind of firewall for your input, preventing data outside the extremes to be processed

MAYBE you could devise some kind of sequence that would break the autofocus system when presented with a specific set of targets, but even then could you inject code once you had broken AF? It seems well beyond practical to be able to do so even just for research purposes.

Re:You missed his point... (2, Interesting)

labradore (26729) | more than 4 years ago | (#33146342)

How about when the camera starts to do face recognition (like most point-and-shoot digicams do today) and also starts to recognize bar codes and the square patterns like the ones that the Android app store uses? How about voice recognition and commands built into the machine? The smarter you make these things, the more complex they become. At a certain level of complexity, you lose assurance that the security works properly. It takes exponentially more time to vet the system as the complexity increases.

Closed and open data streams (1)

SuperKendall (25149) | more than 4 years ago | (#33146938)

How about when the camera starts to do face recognition

That I do not think can do anything, because it's a closed system. You collect points about a face and then look them up in a database of known faces. There's really not any way to inject information in there beyond what the system is expecting.

How about voice recognition and commands built into the machine?

Same thing, because the processing of the input attempts to match into a list of known words. Speaking gibberish can do nothing except simply not form a match.

Now both things could be used as triggers for latent code, like an easter egg - say you used face recognition on morgan freeman and got some quote of his. But it would have to be pre-embedded by a developer.

also starts to recognize bar codes and the square patterns

Well that kind of could work, but only by triggering bugs in other systems because those apps just pass through whatever data they read off the QR code or barcode. There's just a limited possibly set of characters that can be encoded so the code can easily handle all input cases. What would work is, for example, embedding a URL to an infected PDF in a QR Code and placing it somewhere obvious in a bar. You wouldn't get many hits but a few people might trigger it, and if you set said QR codes all over... but the user would have to initiate the scan using an application that was built to forward the data.

The smarter you make these things, the more complex they become. At a certain level of complexity, you lose assurance that the security works properly.

You never have any assurance that security works properly, which is why security systems are developed in layers. Adding more complexity does not necessarily increase security risk as long as the complex systems are compartmentalized from each other. Making really awesome face recognition and great voice recognition wouldn't have any impact on overall security since there are no relations between the two, and all they equate to is fancier lookups into internal databases.

Also, most of those systems have to be triggered by the user - it's the passive, always on systems you really need to be concerned about in terms of security risk. The systems you have to activate just sit there inert regardless of complexity or intelligence.

Re:You missed his point... (2, Insightful)

mrsteveman1 (1010381) | more than 4 years ago | (#33146380)

What makes you think the apps are safely sandboxed if the browser isn't? If the browser isn't sandboxed at all, why the fuck not? If it is and this still happened, then the sandbox isn't all that effective, especially if you can get someone to run code locally and call native APIs.

Browser is sandboxed (2, Insightful)

SuperKendall (25149) | more than 4 years ago | (#33146808)

What makes you think the apps are safely sandboxed if the browser isn't?

For one thing, I'm an iPhone developer so I know the exact constraints of the application sandbox.

But also - the browser is sandboxed. Read details of the attack, it breaks the browser but then ALSO uses a second attack to escape the browser sandbox. The question is if the same thing is possible for any application, or if the sandbox exit is unique to Safari.

But having two exploits in alignment is a rare thing. It's rare enough that exploitable bugs in both systems will be hard to come by, and if malware writers are not exploiting the current bug in Safari why would they do so with the much smaller attack space of any one application?

Re:Browser is sandboxed (1)

LynnwoodRooster (966895) | more than 4 years ago | (#33147036)

It's rare enough that exploitable bugs in both systems will be hard to come by, and if malware writers are not exploiting the current bug in Safari why would they do so with the much smaller attack space of any one application?

That's a mighty big "if" in there... There's no way to know, since root access also means you can completely cover your tracks, leaving no trace that you were even there.

Lots of ways to know (1)

SuperKendall (25149) | more than 4 years ago | (#33147104)

That's a mighty big "if" in there... There's no way to know, since root access also means you can completely cover your tracks, leaving no trace that you were even there.

It's not such a big if given the number of people that are on the lookout for active iPhone exploits. Plus you can always notice by outbound communication or by difference in backups. Also it kind of doesn't matter, because anything that managed to install would only be alive until the next iOS update, which would overwrite wherever it might be hiding.

Re:didn't you just argue FOR the app store? (1)

h4rr4r (612664) | more than 4 years ago | (#33145870)

Considering that tethering and malicious apps have made it through the store is not a safety guarantee.

Security is a percentage game (1)

SuperKendall (25149) | more than 4 years ago | (#33145910)

Considering that tethering and malicious apps have made it through the store is not a safety guarantee.

No-one ever said it was. Security can never be absolute. That's why security is a matter of percentages, and layers... multiple layers work better to protect users. Note this flaw required two exploits to come into alignment, a pretty rare event.

Yes app store reviews can miss things. But App Store apps can be pulled from all devices suddenly with no user involvement (as Google recently had to do). A web site cannot be easily taken down and patching users takes time and willingness on the part of the user to patch.

Re:Security is a percentage game (0)

Anonymous Coward | more than 4 years ago | (#33146722)

Yes app store reviews can miss things. But App Store apps can be pulled from all devices suddenly with no user involvement (as Google recently had to do).

since when has this become a good thing?

A web site cannot be easily taken down and patching users takes time and willingness on the part of the user to patch.

some of us 'users' prefer this, even the ones who otherwise don't know what they're doing. Simply taking the choice away is not a solution. I don't want others, who most likely have conflicting interests with me, reaching into my devices without my knowledge and permission. Speaking of malware, the vendors themselves are often the biggest threats.

Re:Security is a percentage game (1)

SuperKendall (25149) | more than 4 years ago | (#33146878)

since when has this become a good thing?

For the average person this is a very good thing.

Heck, for me I'd appreciate someone using this to pull out a truly evil app. But to date Apple has not used this feature, even for things like tethering apps that you could briefly buy and they removed from the store. As long as the feature is truly used only to block malicious apps it's a good thing for the user.

To my mind it's no different than when I used to have a Linux installation that I configured to automatically download a security update package every night - potentially that could have uninstalled any system app that went rogue. And that would have been fine with me.

some of us 'users' prefer this, even the ones who otherwise don't know what they're doing.

Not really. The ones who "don't know what they are doing" don't really prefer this. They don't know one way or the other.

Simply taking the choice away is not a solution.

Who is taking choice away? That's not what is going on here. Targeted killing of apps with known viruses or exploits that are actively causing harm is not "removing a choice" except by the most warped definition. No civilized society makes legal the "choice" to commit suicide which is the equivalent of "choosing" to continue to run an infected application that is sending your bank data to China.

I don't want others, who most likely have conflicting interests with me, reaching into my devices without my knowledge and permission.

Generally speaking, I don't either. But this aspect is used as I noted only in extraordinary cases.

Speaking of malware, the vendors themselves are often the biggest threats.

Having seen some of what real malware does and been tangentially involved with identity theft, I have to totally disagree with that statement and think it's very naive as to real world malware issues.

Re:didn't you just argue FOR the app store? (1)

Mr2001 (90979) | more than 4 years ago | (#33146330)

I just thought it was odd you were trying to argue against the security benefits of a closed app store using a bug in a totally open browser model.

On an open platform, you'd be able to use a third-party browser when flaws like this are discovered in the built-in browser.

On the iPhone, however, you're stuck with Apple's browser core (no pun intended). Third parties are allowed to post their own WebKit skins in the app store, but those are likely to feature all the same bugs.

Re:didn't you just argue FOR the app store? (1)

SuperKendall (25149) | more than 4 years ago | (#33146822)

On an open platform, you'd be able to use a third-party browser when flaws like this are discovered in the built-in browser.

You could always use Opera MINI on the iPhone.

However it's a poor argument in this case as any third party browser you used would still hand the PDF off to the vulnerable system library to parse and display...

Re:didn't you just argue FOR the app store? (1)

Mr2001 (90979) | more than 4 years ago | (#33146866)

You could always use Opera MINI on the iPhone.

Opera Mini's server-side rendering and minimal interactivity make it unsuitable to replace a native browser for general use, as I'm sure you're aware.

However it's a poor argument in this case as any third party browser you used would still hand the PDF off to the vulnerable system library to parse and display...

... unless it didn't. Third-party browsers could use third-party PDF rendering libraries.

Re:didn't you just argue FOR the app store? (0)

Anonymous Coward | more than 4 years ago | (#33146538)

But the more these things start to look like and function like a general computer, the most likely attack vector is through websites just like on the desktop

You just made the argument for why users should only use applications vetted from a store instead of the general web.

Happily the iPhone actually doesn't impose any restrictions on web use.

I just thought it was odd you were trying to argue against the security benefits of a closed app store using a bug in a totally open browser model.

The point of the app store would then be that the more applications users used, the less exposed they would be to web bugs. We know attackers inject exploits into popular websites all the time.

wow, you want to get rid of the browser as well?

steve? is that you?

Don't look at me. (1)

SuperKendall (25149) | more than 4 years ago | (#33146840)

wow, you want to get rid of the browser as well?

You mistook me for the parent; I was noting how he was forming the argument than users should only use app store apps. Me, I don't think the risk of possibly infected web pages warrants closing off the web to any device. I'm all about open standards.

Re:Falsely implied security (0)

Anonymous Coward | more than 4 years ago | (#33145774)

Yep! Oh, was that a rhetorical question?

Now I like a good apple bash (0)

mjwx (966435) | more than 4 years ago | (#33145608)

But...

Two unpatched flaws. What kind of reporting is this? If they were patched there wouldn't be a problem. Do we really need to keep sticking unnecessary and redundant words into a headline? If these flaws have been around for a while you could say "two flaws in IOS remain unpatched" but really, "two unpatched flaws". I'd hate to think what will happen when we find patched flaws.

The funny thing is it's not even accurate (1, Interesting)

SuperKendall (25149) | more than 4 years ago | (#33145642)

Two unpatched flaws

The really funny thing is, that by adding those words they made the statement wrong - there are patches (PDF for sure), already in 4.1. 4.1 includes a PDF fix for a Mac OS X vulnerability reported on well before this week.

But 4.1 is not yet public (though it should be very soon now).

Re:Now I like a good apple bash (1)

Avuserow (1527203) | more than 4 years ago | (#33145644)

I imagine that if we find patched flaws, the headline should go something like "iPhone OS 4.0.1 update patches two flaws".

Re:Now I like a good apple bash (1)

pclminion (145572) | more than 4 years ago | (#33145878)

I'm not sure where you get the idea that patched flaws are harmless. In the industry these are commonly called "1-day" exploits. There is an entire community centered around the analysis of vendor updates and patches in order to figure out the exact nature of the security flaws which are being patched -- these flaws are then exploited in the wild on systems which aren't patched yet.

The whole world doesn't suddenly get fixed when a vendor releases an update. You may have thousands or millions of vulnerable systems for months, and some people just never patch at all. Getting the patch out is just the beginning of a long process of securing that particular vulnerability.

Re:Now I like a good apple bash (1)

mjwx (966435) | more than 4 years ago | (#33146946)

I'm not sure where you get the idea that patched flaws are harmless.

Where you got that idea from I do not know.

In context, do you expect "two patched flaws show up in foo". The headline insinuated the flaws are new (to "show up"), if they had been patched surely it is a logical conclusion to say that the flaws have previously been discovered. Even if a patch fails to fix a known exploit, is it not reasonable to say the flaws are still unpatched?

Saying the flaw was "unpatched" was done for effect and is entirely redundant.

You may have thousands or millions of vulnerable systems for months, and some people just never patch at all.

But this still does not make a "patched flaw", it makes it a flaw for which a patch exists.

Security-through-obscurity no more (4, Insightful)

by (1706743) (1706744) | more than 4 years ago | (#33145616)

Although various Windows versions may well be less secure than their contemporary Mac versions, Windows was always more vulnerable simply because there was a bigger incentive to attack it (i.e., more users).

Seems that Apple is now paying the price for popularity.

The price not paid (2, Insightful)

SuperKendall (25149) | more than 4 years ago | (#33145664)

Seems that Apple is now paying the price for popularity.

What price? There are as yet no malicious attacks that make use of this attack vector. The only thing that does is using it as a utility that the user invokes on purpose, and even has to swipe to activate it!

Currently Apple users are not paying any price despite having a very popular mobile platform that every now and then has well-publicised vulnerabilities. Hmm.

Re:The price not paid (1, Funny)

beej (82035) | more than 4 years ago | (#33145850)

Currently Apple users are not paying any price despite having a very popular mobile platform that every now and then has well-publicised vulnerabilities. Hmm.

Apple products are only free if your money is not worth anything. ;-)

Re:The price not paid (2, Insightful)

Dragonslicer (991472) | more than 4 years ago | (#33146056)

There are as yet no malicious attacks that make use of this attack vector.

That we know about.

Good point, but then it doesn't matter (2, Insightful)

SuperKendall (25149) | more than 4 years ago | (#33146126)

That we know about.

True, but if we have not heard of any then the infection rate is pretty low - after all you have to get the exploit up on a site and then get the person to visit that with the iPhone browser.

I would argue that most browser use on mobile devices is going to well-known sites (like your favorite news site, bank, etc) so the chances of a rogue website affecting random users seems pretty low.

Given there's working example code showing how to use the exploit you would actually expect something harmful pretty soon, but I've seen no signs of anything. Perhaps anyone who would target it figures since a patch will be out in a few days there's not enough potential gain.

Re:The price not paid (0)

Anonymous Coward | more than 4 years ago | (#33146582)

There are as yet no malicious attacks that make use of this attack vector.

That we know about.

FUD?

Re:Security-through-obscurity no more (0)

DJCouchyCouch (622482) | more than 4 years ago | (#33145704)

Yep, I'm sure they're really regretting that whole "success" and "profit" thing right now.

Patched in 4.1... (0)

SuperKendall (25149) | more than 4 years ago | (#33145622)

4.1 is probably out very soon now, and I believe it was reported the PDF bug at least is closed (and I assume the other). It's debatable if they should wait even a week for a fix, but as long as there are no malicious exploits in the wild it doesn't matter much to users... I'd bet Apple is sitting on an emergency patch to issue if they had to, but they'd rather just get 4.1 out.

Re:Patched in 4.1... (1)

jo42 (227475) | more than 4 years ago | (#33145702)

iOS 4.1 beta 3 came out only a week after beta 2. Usually beta releases are two weeks apart. This indicates 4.1 should be out Real Soon Now. They also fixed the iPhone 4 proximity sensor issue in b3. It also looks like 4.1 works better on older iDevices (iPhone 3G, iPod touch 2nd gen) than 4.0 does (which was rushed out to meet the iPhone 4 shipping date not doubt).

Re:Patched in 4.1... (1)

Albanach (527650) | more than 4 years ago | (#33145730)

And this poses an conundrum for those that jailbreak with this flaw. Assuming it doesn't fix the flaw itself, you're still left exposed with a device vulnerable to malicious rooting.

Do you sit on your unpatched version of iOS, knowing that any malicious site can root your handheld device, or do you give up the freedoms you obtained and patch for safety?

Patch may not affect jailbreak. (2, Informative)

SuperKendall (25149) | more than 4 years ago | (#33145796)

Often the patches will not undo already jailbroken systems. So there's that possibility.

But if someone finds they like the jailbreaking, they can just use whatever mechanism will come along to jailbreak 4.1. Usually it's not as dramatic as a browser bug and it involves running an application on your main computer to alter your attached device, but it's easy enough for anyone interested to keep going.

Another option is that jailbreakers can simply replace the 4.0 PDF library with the 4.1 version (if compatible).

Re:Patched in 4.1... (1)

socsoc (1116769) | more than 4 years ago | (#33145872)

There'll likely be other ways of jailbreaking. PwnageTool supported jailbreak pretty soon after 4.0 dropped.

Wait for the dev team, patch your phone and carry on.

Re:Patched in 4.1... (2, Informative)

Anubis350 (772791) | more than 4 years ago | (#33145930)

Actually, at the moment, only jailbreakers can be *safe* from this vulnerability. Google "PDF Loading Warner". Ironic, isn't it?

Pure Epic (-1, Flamebait)

Anonymous Coward | more than 4 years ago | (#33145754)

Not so secure now, huh Apple? Even their own experts have admit that their products could crumble because of how unsecure they are.

Re:Pure Epic (1)

jellomizer (103300) | more than 4 years ago | (#33145798)

So when android takes over iPhone market. Can we be as smug about volerabilies that come up.

Re:Pure Epic (1)

GNUALMAFUERTE (697061) | more than 4 years ago | (#33145926)

Command Syntax of the ultimate computer languge: DoWhatIWant() DoItFaster(Function), eg. DoItFaster(DoWhatIWant()

It still won't work because you are missing a closing parenthesis at the end.

Apple bans PDFs... (3, Funny)

trboyden (465969) | more than 4 years ago | (#33145880)

This just in... Apple bans PDFs on Apple devices... Steve Jobs was quoted as saying "PDFs are yesterday's portable documents - nobody uses them anymore. So we've decided to stop supporting PDFs on Apple devices. In addition, we've decided to not allow any media on our devices that you can't obtain through the iTunes Store. This way nobody can make our devices unstable and insecure like kernel vulnerabilities and overheating chipsets - oh wait..."

Re:Apple bans PDFs... (-1, Offtopic)

trboyden (465969) | more than 4 years ago | (#33145914)

What's the matter Apple Fanboi moderator, can't take a joke?

Products based on exploits (5, Interesting)

Calibax (151875) | more than 4 years ago | (#33145888)

I don't know if this scenario is valid, as I don't have an iPhone that can run iOS4. But here goes anyway.

So someone takes their iPhone and jailbreaks it. The two bugs that allowed this are still present in the jailbroken phones so the phones can also be pwned by anyone who comes up with a different exploit that uses these bugs. Clearly the phones can't be updated to 4.1 (as they are jailbroken) so unless someone produces patches independently of Apple they will remain in these jailbroken phones until they are discarded or reset to the official post 4.1 iOS. I wonder how many non-geeks who are persuaded to jailbreak their phones will realize this.

Here's the root of the issue. When someone decides to use an exploitable bug for their own purposes they are not doing any favors for themselves or their users. Exploitable bugs should be reported so they can be fixed, not used to develop your own products - however popular the products might be in some circles. That might well be an unpopular view in this forum, but there it is.

They can be patched though (1)

SuperKendall (25149) | more than 4 years ago | (#33145994)

Clearly the phones can't be updated to 4.1

Why not? Jailbreaking doesn't prevent all the normal system stuff from operating as it should, you still sync with iTunes and it would still check for updates. The only downside is that it MAY break the jailbreaking. But even then something like MiFi might well still work.

so unless someone produces patches independently of Apple

Jailbreakers may well do that, they sometimes make modification to system apps as part of the jailbreak.

I've always said that when you jailbreak, at taht point you take a divergent path from Apple's update stream, as you laid out. However in practice, that has not really been true - jailbreak updates almost always follow in a week or two from the official release of a new version of the OS, so you simply update and re-jailbreak - to date Jailbreakers haven't really had to stay diverged from Apple's updates.

After all, the guys who work on jailbreaking get the same pre-release OS all the other developers get, so they have time to formulate new entry points.

Exploitable bugs should be reported so they can be fixed, not used to develop your own products

I agree bugs should be reported and that is the more responsible path, but I don't see anything wrong with making use of the exploits that exist for peaceful purposes.

Re:They can be patched though (0)

Anonymous Coward | more than 4 years ago | (#33146052)

I do have a jailbroken 3g phone. I did try to update and I couldn't. iTunes would let me reset the phone to factory defaults but it wouldn't let me update it.

Make use of exploits for peaceable purposes? Come on, get back to planet Earth. If you have found the exploits, the bad guys have found them also.

Other thing to try... (1)

SuperKendall (25149) | more than 4 years ago | (#33146146)

I do have a jailbroken 3g phone. I did try to update and I couldn't. iTunes would let me reset the phone to factory defaults but it wouldn't let me update it.

Did you try resetting the phone, installing the update, jailbreaking again, then restoring from a backup? Usually that migrates in applications and data files. Sort of the same as an update but more roundabout.

Make use of exploits for peaceable purposes? Come on, get back to planet Earth. If you have found the exploits, the bad guys have found them also.

Of course, but just because there are bad uses of the exploits why not write some good ones while the exploits exist? I'm not arguing that Apple should not patch the system, I'm just saying I don't see anything wrong with turning some aspect of a bad situation into a good one.

The only downside is that publishing a positive exploit shows everyone else how to use the same exploit. But then as you say, the bad guys already know about it, probably well ahead of the person writing a positive use for an exploit.

Re:Products based on exploits (1)

number17 (952777) | more than 4 years ago | (#33145998)

1) The community has a fix for the exploit [ http://obamapacman.com/2010/08/cydia-pdf-loading-warner-helps-prevent-ios-security-hole-exploit/ [obamapacman.com] ] 2) As you mentioned, when 4.1 or 4.0.1 is released just upgrade and jailbreak

Re:Products based on exploits (1)

fightinfilipino (1449273) | more than 4 years ago | (#33147032)

that isn't so much of a "fix" as it is a warning screen before a user loads any PDF on his or her iOS device. considering the "typical user", that person will most likely impatiently click to ignore the warning anyway whenever it pops up, assuming that the user bother to install the warning app at all.

Re:Products based on exploits (1)

jd2112 (1535857) | more than 4 years ago | (#33146120)

Exploitable bugs should be reported so they can be fixed, not used to develop your own products - however popular the products might be in some circles. That might well be an unpopular view in this forum, but there it is.

Back in the days when Windows 3.x and 95 roamed the Earth that was the most common way to compete with Microsoft and their undocumented APIs.

Re:Products based on exploits (0)

Anonymous Coward | more than 4 years ago | (#33146724)

"Exploitable bugs should be reported so they can be fixed, not used to develop your own products"

Yea, right. The reality is that most discoveries of exploitable bugs these days get parlayed into a career with a three letter agency, or sold to the highest bidder (who is also usually a three letter agency, or a mafia, or both). The days of posting that 0day to BugTraq are well and truly behind us.

"Real PC user experience", as requested (0, Troll)

Anonymous Coward | more than 4 years ago | (#33146034)

Everyone here clearly doesn't appreciate the immense effort that Apple has expended to bring people the "real PC user experience" on their phones, just like all the butthurt Android fantards keep whining about. Now you can enjoy "real PC features" like losing 10% of battery life to ineffective but performance-sapping virus scanners!

Fix is already done, will ship any moment (2, Interesting)

gig (78408) | more than 4 years ago | (#33146476)

Apple announced earlier today that they already have a fix and it will roll out soon. It takes about 2 weeks to update half the platform, and another month to get most of the rest.

Just Apple Racism! (0)

Anonymous Coward | more than 4 years ago | (#33146728)

It's only racism!

Why bother?

How will Apple correct this? (5, Funny)

chrism238 (657741) | more than 4 years ago | (#33146826)

Will Apple just place the patch in a PDF file on their website, for us all to download and auto-install?

Re:How will Apple correct this? (-1, Flamebait)

pootypeople (212497) | more than 4 years ago | (#33147034)

Now that's a clever comment. Wish I had some mod points.

I am very offended by slashdot adding some bullshit time between postings "feature." Maybe I'll find a new forum where my freedom of speech isn't subject to the whims of software developers.

Or, in more plain language: FUCK YOU FOR FILTERING SLASHDOT. WTF ARE YOU THINKING?

WTF (2, Insightful)

pootypeople (212497) | more than 4 years ago | (#33147020)

Everyone does realize that the OS of their smartphone has no relation to dick size, right?

What the hell are folks arguing about, anyways? I would figure it's pretty awesome we live in an age where we can decide from multiple choices what advanced operating system will run our phone. That actually gets toward shit I wouldn't have expected growing up.

But I guess folks have been getting pissed about other people's choice of OS for years. I really wish I understood why people get so pissed about that sort of thing. Operating systems are tools, not cults.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>