Turning Phones Into Computers Means They'll Have Computer-Like Security Issues

from the hack-me dept

A security expert claims that he's managed to remotely crack the iPhone. All that's required to pull off the crack is to get the user to visit a specially-crafted website that exploits vulnerabilities in the iPhone's Webkit-based web browser. Once the iPhone has been cracked, the attacker has complete control over it, including the ability to download the user's email and voicemail, and even to surreptitiously activate the iPhone's microphone and transform the iPhone into an eavesdropping tool. It's scary stuff, and it illustrates an important point about the iPhone and other smart phones: as our phones get more and more computer-like capabilities, they're going to face more and more computer-like security problems. And that means that phone manufacturers and users will need to be more aware of the risks of security breaches and take appropriate precautions. In this case, it appears that Apple's choice to lock out third-party applications has actually backfired. Because all of the apps on the iPhone are written by Apple, they apparently all run as the "root" administrative user. That means that there's no attempt to protect the phone from a misbehaving application. As soon as you compromise one application, such as its browser, you've cracked the whole phone and can do anything you want with it. That's in contrast to Mac OS X, which typically runs applications as a non-privileged user, giving the OS an added layer of protection in case an application gets compromised. Had Apple designed the iPhone as an open platform from the ground up, it's likely they would have paid more attention to the iPhone's security model, limiting the damage that one rogue application could do. Presumably, with the announcment of a third-party development platform for the iPhone, Apple is hard at work implementing those kinds of security precautions. But this isn't a threat that's amenable to a quick fix. Apple and other smartphone developers are going to have their work cut out for them trying to add new functionality to their products without exposing their customers to new security threats.

Filed Under: , ,
Companies: apple

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Turning Phones Into Computers Means They'll Have Computer-Like Security Issues”

Subscribe: RSS Leave a comment
Ed Wrenbeck says:

Falling into the 'root' trap

There has been much made about the fact that apps run as root on the iphone. The reality is that the interesting things on the phone are the users data. Any vector that was able to infect an Application running as root or as a user account would have the same effect for that user on any system. In the case of a phone, the difference is that there is only one user.

Adam Slagle says:

This “security expert” managed to use a well-documented flaw in the .tiff handler – one that everybody and their mothers know about, as that’s exactly how some of the jailbreak applications open the iPhone up to third-party applications.

Apple patched this in 1.1.2, and and if you want to stay on 1.1.1, you can use a jailbreak that fixes the flaw behind itself, or use a third party application to fix it.

Is it news if you take a well-publicised flaw that’s already been patched and attach a payload to it? Or is it just someone capitalizing on the fact that most people don’t read past headlines?

OKVol says:

How many people just want a cell phone to call som

I don’t want e-mail and web browsing 24 hours/day. I don’t want to make Sprint rich by downloading new ring tones, I don’t text anyone, I only attempted twice to use PTT with Nextel and it sucked worse than CB radios in the 1970s. The only cool use I have for my RAZR is playing MP3s while I work out.

Phil says:

Turning Phones Into Computers Means They'll Have C

Take a look at the crystal ball: As the amount of Mac users increase, so will security attacks on the computers. All members of the “Mac cult” will learn this lesson soon. Maybe not today, maybe not tomorrow, but it’s only a matter of time before Macs become prone to virus and spyware just like PCs. Apple will soon find out their impenetrable fortress of security with no security software will just leave Macs open to attack in the future, because it’s not a result of the greatness of Apple software just the fact that the market share of Macs is so low that it’s not worth it to build malicious software for it.

It’s happening on the iPhone now, it’s going to happen on Macs in the future. Anyone who thinks otherwise is delusional.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...