It’s not the first time this has happened, last time jailbreakme did the same thing back in August 2010 – Dangerous iPhone iOS JailBreak Exploit Goes Public.

The exploit is quite a nasty one, and the irony is this time – only users that have applied the Jailbreak then the additional ‘PDF Patcher 2′ software (from Cydia) are safe from this. Users running the vanilla version of iOS are actually at risk.

Hours after developers revealed they had exploited bugs in Apple’s iOS to “jailbreak” iPhones and iPads, German government security authorities warned that one of the flaws could be put to malicious use.

Malformed files that exploit the vulnerability have been publicly posted on the Internet. Late Wednesday, Germany’s Federal Office for Information Security, known by its German-language initials of BSI for “Bundesamt fuer Sicherheit in der Informationstechnik,” warned citizens that the iOS bug could be used by criminals to hijack iPhones, iPads and iPod Touches.

“Even clicking a crafted PDF document or surfing to a website with the PDF documents are sufficient to infect the mobile device with malicious software,” the BSI said in a translation of the German-language alert .

PDF files that successfully exploit the vulnerability are available on the Web, according to Mikko Hypponen, chief research officer of Helsinki-based antivirus company F-Secure. And those PDFs could be used by miscreants to hack iOS devices simply by luring users to malicious sites, said Andrew Storms, director of security operations at nCircle Security.

iPhone and iPad users steered to a malicious PDF — via a link embedded in an email, for instance — would not receive any warning or be required to take additional action.

I hope Apple gets their act together and pushes out the patch for this ASAP as I foresee some kind of iPhone/iPad targeted worm coming out of this fairly shortly.

It took them 10 days to patch a similar pair of exploits back in August 2010 so we should be expecting a patch by the end of this week (mid-July sometime).

The worrying part when it comes to business/agencies/government etc – is that these exploits could be used to target specific individuals of importance. All you need to know is the e-mail address they access on their iPhone/iPad and do a bit of social engineering and you’re in.

The BSI warning came just hours after a group of developers released an updated version of JailbreakMe, a tool that hacks iOS so iPhone and iPad users can install software not sanctioned by Apple.

Those developers exploited a pair of vulnerabilities, including one in the font parsing of the PDF viewer integrated with the iOS version of Safari, and another that bypassed anti-malware defenses such as ASLR (address space layout randomization). Wednesday, security experts said that the same vulnerabilities, particularly the one exploitable through malicious PDF files, could be used by criminals to hijack Apple’s popular iPhone and iPad.

“They’re certainly a threat, and would be easy to make malicious,” said Charlie Miller, a noted Mac OS X and iOS vulnerability researcher who works for Denver-based Accuvant.

Miller also speculated that Apple would quickly patch the vulnerabilities, perhaps even faster than last year when it faced a similar situation. In August 2010, Apple patched a pair of bugs used by JailbreakMe 2.0 just 10 days after the tool’s release. News of JailbreakMe 3.0′s impending release had leaked several days before Wednesday’s official launch, noted Miller, and should have given Apple even more warning.

Yesterday’s BSI alert was similar to one it issued last August after JailbreakMe 2.0 appeared.On Thursday, Apple said it would fix the flaws.

Of course the ‘developer’ version of iOS 5.0 is already out and I guess someone people are using this, most iPhone/iPad users have been waiting for that major update – but I’m guessing Apple will have to push a patch out for this before the 5.x major release.

There’s another interesting and relevant article on this topic here:

The problem with doing – and not doing – an iPhone jailbreak

It’ll be interesting to see what comes of this and if any kind of iPhone/iPad chaos is going to occur due to these exploits.

Source: Network World

Now it wasn’t long ago when the first malicious iPhone worm appeared in the wild and well generally since the boom of the device people have looking at the security measures.

Huge sales are made to corporates touting the security, privacy and encryption features of the iPhone OS. The latest discovery is that using a PIN on your iPhone 3GS really doesn’t protect you from anything as long as the person has physical access to your phone.

But then the same thing goes for desktop/laptop computers too, if someone has physical access you’re done for.

Using a four-digit PIN to lock your iPhone doesn’t really protect your data, security and IT blogger Bernd Marienfeldt has discovered. In an article describing the iPhone’s business security framework, Marienfeldt has found a “data protection vulnerability” in Apple’s iPhone 3GS.

Marienfeldt, working with security expert Jim Herbeck, has been able to reproduce the vulnerability on at least three non jail-broken iPhone 3GS handsets with different iPhone OS versions installed (including the latest). All tested iPhones were protected with a four-digit PIN.

In Marienfeldt’s own words:

“The unprotected iPhone 3GS mounting is “limited” to the DCIM folder under Ubuntu < 10.04 LTS, Apple Macintosh, Windows 2000 SP2 and Windows 7. The way Ubuntu Lucid Lynx handles the iPhone 3GS [6,7,8] allows to get more content (please do make sure that the native Ubuntu system is fully up to date, e.g. "apt-get update, "apt-get upgrade" - any virtualization based solution will not work as described). I used the Alternate CD with x86 and AMD64 on different hardware."

I guess with phones/embedded system we expected the user data to a little more secure and well we guessed wrongly. With a total of 33.75 million iPhones sold up to Q4 2009 that’s a staggering amount of vulnerable devices out there.

Another issue is Apple haven’t as yet worked out what the problem is, they’ve given some vague mentions of “race conditions” or “a pairing issues” but haven’t been able to reproduce it so far.

Other people have had varying success in exploiting the flaw, it seems to depend on the actual iPhone itself rather than anything else.

Basically, plugging an up-to-date, non jail-broken, PIN-protected iPhone (powered off) into a computer running Ubuntu Lucid Lynx will allow the people to see practically all of the user’s data–including music, photos, videos, podcasts, voice recordings, Google safe browsing databases, and game contents. The “hacker” has read/write access to the iPhone, and the hack leaves no trace.

According to Marienfeldt, “The allowed write access could also lead into triggering a buffer overflow.” A buffer overflow could allow full write access, and full write access could potentially lead to the attacker being able to make phone calls (as far as we know, the attacker can access all of your data but they can’t make any phone calls…how reassuring).

Marienfeldt points out that this is especially an issue for corporate/business users, who “rely on the expectation that their iPhone 3GS’s whole content is protected by encryption with a passcode based authentication in place to unlock it.”

Apple has been notified of the flaw, but has yet to correct it (or give a timeline for the correction).

I hope Apple can address this phone and give a proper breakdown and explanation of why this happens, there must be some technical explanation for it and why it occurs in their so called ‘secure’ implementation.

You can read the original blog post here:

iPhone business security framework

Source: Network World

With the latest version of the Apple iPhone OS being released last night or this morning (depending where in the World you are) I guess most of the iPhone users amongst you would have already installed the software.

Everyone I know using an iPhone has already done it without a hitch, it’s been long awaited and it’s definitely an improved over version 2.0.

The new OS also includes patches for 46 previously unpatched security vulnerabilities in the version 2.0 OS.

Apple releases iPhone OS 3.0 to much fanfare. In addition to new features, the updated iPhone operating system brings several patches that address serious security issues in the mobile device.

Apple quietly plugged nearly four dozen security holes when it pushed out an upgrade to iPhone OS 3.0 on June 17.

With iPhone OS 3.0, users are getting fixes for several critical flaws, a number of which could be exploited by an attacker to execute arbitrary code. The WebKit and CoreGraphics components were the most vulnerable with 21 and eight vulnerabilities, respectively.

There are several serious flaws being fixed in this update, so even if you don’t need the features please update for the security.

Let anyone else you know using the iPhone to update too.

Apple’s advisory on the issues can be found here.

The Apple iPhone OS 3.0 contains more than 100 new features, some of which were aimed squarely at enterprises. In March, Apple gave about 50,000 individuals who paid to be part of the company’s developer program access to both the updated SDK (software development kit) and the beta version of the operating system as part of an effort to bring more secure business functionality to the iPhone.

The popularity of the iPhone and other smartphones has brought about an increased interest in properly securing and managing the devices. Along those lines, the Center for Internet Security just released a benchmark with advice on using the iPhone securely.

“Phones are small and relatively cheap, and fashionable, so many companies still don’t realize—or don’t want to acknowledge—that they can be as serious in terms of breach effects as a laptop or desktop PC,” Gartner analyst John Girard said.

I would take a wild guess though with 100 new features introduced that Apple has also introduced some security vulnerabilities.

I’d give it a week or so before some issues start to pop up with the new OS.

Companies do need to look at the security of mobile devices seriously, that’s partially why BlackBerry is so popular as it’s easy to setup secure communications and lock down the device.

Source: eWeek

Once again Apple iPhone has been unlocked by a determined youngster, the same who was amongst the first to unlock it last year winning himself a rather nice car and a few 8gb iPhones.

It just shows nothing is infallible, all he needed to find was a writable memory address and he was pretty much done (he used a much higher range of registers than previously).

A teen hacker known for his deftness with iPhones has figured out how to unlock models running the latest firmware versions by cracking a protection that has frustrated hackers for weeks.

The breakthrough by George Hotz, aka Geohot, means people who have bought a recent iPhone will once again be able to use it on the phone network of their choice. Apple makes as much as $400 for every handset that’s activated on an approved network, so its developers have worked hard to prevent the so-called unlocking of iPhones.

A very smart young man indeed, just showing 1 person can indeed defeat the security of a huge multi-national billion dollar company.

And he’s done it twice.

The latest salvo was fired late last week, following a 24-hour hacking spree by Geohot that was broken up by only three hours of sleep. It turns out the latest firmware contained modifications to the device’s memory registers to prevent unlocking. Geohot worked around those changes by finding another, much higher register that was vulnerable.

“I guess Apple thought big numbers were harder to guess,” he wrote.

He then found a way to install his custom-built code by exploiting a flaw that allowed him to erase a range of memory addresses where security software is stored.

An amazing 27% of iPhones are running on unauthorized networks which means they are cracked. Of course Apple will soon come out with a new firmware update that negates this problem….but then the game will just start all over again.

And no one doubt Geohot or someone like him will break it again.

If you want to know how to do it check out step-by-step instructions here from iClarified here.

Source: The Register