Turning Phones Into Computers Means They'll Have Computer-Like Security Issues

from the hack-me dept

A security expert claims that he's managed to remotely crack the iPhone. All that's required to pull off the crack is to get the user to visit a specially-crafted website that exploits vulnerabilities in the iPhone's Webkit-based web browser. Once the iPhone has been cracked, the attacker has complete control over it, including the ability to download the user's email and voicemail, and even to surreptitiously activate the iPhone's microphone and transform the iPhone into an eavesdropping tool. It's scary stuff, and it illustrates an important point about the iPhone and other smart phones: as our phones get more and more computer-like capabilities, they're going to face more and more computer-like security problems. And that means that phone manufacturers and users will need to be more aware of the risks of security breaches and take appropriate precautions. In this case, it appears that Apple's choice to lock out third-party applications has actually backfired. Because all of the apps on the iPhone are written by Apple, they apparently all run as the "root" administrative user. That means that there's no attempt to protect the phone from a misbehaving application. As soon as you compromise one application, such as its browser, you've cracked the whole phone and can do anything you want with it. That's in contrast to Mac OS X, which typically runs applications as a non-privileged user, giving the OS an added layer of protection in case an application gets compromised. Had Apple designed the iPhone as an open platform from the ground up, it's likely they would have paid more attention to the iPhone's security model, limiting the damage that one rogue application could do. Presumably, with the announcment of a third-party development platform for the iPhone, Apple is hard at work implementing those kinds of security precautions. But this isn't a threat that's amenable to a quick fix. Apple and other smartphone developers are going to have their work cut out for them trying to add new functionality to their products without exposing their customers to new security threats.


Reader Comments (rss)

(Flattened / Threaded)

  •  
    identicon
    Anonymous Coward, Nov 19th, 2007 @ 10:43pm

    Obvious headline is obvious

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Overcast, Nov 20th, 2007 @ 5:39am

    Does he *have* to use AT&T to crack it? Or can he use any Telco/ISP?

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    jon, Nov 20th, 2007 @ 6:02am

    Meh, sounds like it's using the tiff exploit that was recently patched with the 1.1.2 update. Anything that communicates with the outside world is in danger of being hacked. Hopefully Apple and the rest of the folks can stay on top of things and keep the boogie man out.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Ed Wrenbeck, Nov 20th, 2007 @ 6:03am

    Falling into the 'root' trap

    There has been much made about the fact that apps run as root on the iphone. The reality is that the interesting things on the phone are the users data. Any vector that was able to infect an Application running as root or as a user account would have the same effect for that user on any system. In the case of a phone, the difference is that there is only one user.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    ProphetBeal, Nov 20th, 2007 @ 6:08am

    Only a matter of time

    It was only a matter of time before this issue came to light. As technology changes and evolves so must the security for this new innovations.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Nov 20th, 2007 @ 6:52am

    Very old news

    Charlie Miller created a remote exploit within a month of the iPhone's release.

    http://www.forbes.com/security/2007/08/04/iphone-apple-mac-tech-cx_ag_0804miller.html

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Adam Slagle, Nov 20th, 2007 @ 6:54am

    This "security expert" managed to use a well-documented flaw in the .tiff handler - one that everybody and their mothers know about, as that's exactly how some of the jailbreak applications open the iPhone up to third-party applications.

    Apple patched this in 1.1.2, and and if you want to stay on 1.1.1, you can use a jailbreak that fixes the flaw behind itself, or use a third party application to fix it.

    Is it news if you take a well-publicised flaw that's already been patched and attach a payload to it? Or is it just someone capitalizing on the fact that most people don't read past headlines?

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Anonymous Coward, Nov 20th, 2007 @ 7:34am


    Presumably, with the announcment of a third-party development platform for the iPhone, Apple is hard at work implementing those kinds of security precautions.


    Not if they are going to require the applications to be code-signed by Apple to run, as has been indicated.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Freedom, Nov 20th, 2007 @ 10:44am

    Wrong Headline...

    The right headline should be 'iPhones are prone to attack'.

    After all, haven't we heard that if you just buy a product from Apple instead of the evil-MS Empire you don't have to worry about viruses, spyware, and/or trojans? I hope this helps stop the common belief that one particular setup is immune from this c*ap.

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    OKVol, Nov 20th, 2007 @ 11:51am

    How many people just want a cell phone to call som

    I don't want e-mail and web browsing 24 hours/day. I don't want to make Sprint rich by downloading new ring tones, I don't text anyone, I only attempted twice to use PTT with Nextel and it sucked worse than CB radios in the 1970s. The only cool use I have for my RAZR is playing MP3s while I work out.

     

    reply to this | link to this | view in chronology ]

    •  
      identicon
      Anonymous Coward, Nov 20th, 2007 @ 4:05pm

      Re: How many people just want a cell phone to call

      Right on. The iPhone is an expensive useless mini computer that's hard to do anything on.

       

      reply to this | link to this | view in chronology ]

  •  
    identicon
    Hackers, Nov 20th, 2007 @ 2:45pm

    All your iPhones are belong to us!

     

    reply to this | link to this | view in chronology ]

  •  
    identicon
    Phil, Nov 20th, 2007 @ 3:51pm

    Turning Phones Into Computers Means They'll Have C

    Take a look at the crystal ball: As the amount of Mac users increase, so will security attacks on the computers. All members of the "Mac cult" will learn this lesson soon. Maybe not today, maybe not tomorrow, but it's only a matter of time before Macs become prone to virus and spyware just like PCs. Apple will soon find out their impenetrable fortress of security with no security software will just leave Macs open to attack in the future, because it's not a result of the greatness of Apple software just the fact that the market share of Macs is so low that it's not worth it to build malicious software for it.

    It's happening on the iPhone now, it's going to happen on Macs in the future. Anyone who thinks otherwise is delusional.

     

    reply to this | link to this | view in chronology ]


Add Your Comment

Have a Techdirt Account? Sign in now. Want one? Register here
Get Techdirt’s Daily Email
Save me a cookie
  • Note: A CRLF will be replaced by a break tag (<br>), all other allowable HTML will remain intact
  • Allowed HTML Tags: <b> <i> <a> <em> <br> <strong> <blockquote> <hr> <tt>
Follow Techdirt
A word from our sponsors...
Essential Reading
Techdirt Reading List
Techdirt Insider Chat
A word from our sponsors...
Recent Stories
A word from our sponsors...

Close

Email This