Money will buy a fine dog, but only kindness will make him wag his tail
|
|
|
Apple iPhoned bugged again
HACKER Charlie Miller has found another security vulnerability in Apple's iPhone.
Miller, who works for Independent Security Evaluators has proved that it was a myth that it was impossible to run shellcode on an iPhone.
For some reason, the design geniuses left access to shell code under the bonnet of the iPhone leaving it less secure than a Windows PC without a firewall or virus checker.
Miller said he's found a way to trick the iPhone into running code that enables shellcode. True, you have to target some other vulnerability to to use the information, but once you have one you are laughing.
You could apparently use the command line to run what ever you wanted.
Miller has not called the flaw a vulnerability, he just thinks that Apple engineers may have overlooked the possibility. Apple also has certainly never said it is impossible to run shellcode on an iPhone.
Smug Apple fanboys persuaded that their code is perfect and much more secure than anything else will be getting the willies now, we imagine. µ
L'INQ
Computerworld
Share this:
Share
It's funny how the reaction to any Apple exploit is met with such defensiveness instead of inquisitiveness that would be more healthy for anyone using one.
Do you know who Charlie is? PWN to OWN ring a bell boys?
That he doesn't know a current backdoor doesn't mean it doesn't already exist somewhere yet undiscovered.
That you guys think the device is invulnerable means you're ignorant of the previous flaws, the biggest one early in Safari allowing people to do just what Apple would get sued by AT&T for not trying to stop... jailbreaking. All it took was surfing to http://jailbreakme.com/ then clicking a simple link and voila, full access to do what Apple definitely didn't want you to do.
So are you so sure there's not another similar hole out there just ripe for this exploit? 'Cause you'll be betting any further personal or financial transaction you do on that assumption.
Just FYI PWN to OWN is coming to the Mobile space next year as well, and expect exploits a many being exposed at that time, which we're all ignorant of until then, just like Charlie left this year's PWN to OWN flaw 'un-discovered' until HE exploited it for personal gain, now put those skill in a little greedier hands and you may regret your ignorance and arrogance.
BTW Steve, that no one knows your current vulnerability (aka method of entry) doesn't mean they could figure it out when they get to your house, and that's why the flaw being reported is important even if there's not a publicly known exploit, people are creative and might create the window or door that didn't exist until they got there. That's the point.
Safety of Apple products is inversely proportional to the amount of hackers trying to break it.
Therefore to make iPhony more secure they should increase its already absurd price thus having more units released to the market. Less hackers would be able to grab one and less flaws would be exposed.
At least this is how OSX is taken as "safe" so far. So, yeah, Apple fanboys do pay for their safety. Idiotic but true.
In fact I don't own a single apple product.
However this article is like telling me my money is at risk because I left it on the table in a house... A house with no doors, windows or known method of entry!
Hardly a quake in the boots moment is it!
without poor research, worse comprehension and wildly overblown claims.
To quote from the original "To run shellcode, however, an attacker would first need a working exploit for an iPhone, or a way to target some software vulnerability in, for example, the Safari Web browser or the mobile's operating system. Miller said he doesn't have one now." So to compare this to a PC attack, you'd be able to access the Windows system IF you had an exploit to break in to the machine (and no, AntiVirus code won't help much if someone HAS broken in).
So no, it's not an exploit, it's a potential lever for hackers if they do find one.
let me get this straight..
They discover that you can run Shell script on an iPhone (which is something that on the face of it is actually rather cool), but to do so, you need to have broken the phone's security anyway?
Not really much of a vuln on it's own then..