Dangerous iPhone iOS JailBreak Exploit Goes Public


Apple just released a patch for iOS that fixes the vulnerability that was being used by JailbreakMe website to exploit a weakness in PDF handling to Jailbreak the device.

Shortly after that the developer of the JailbreakMe exploit released the code to the public via GitHub. The code is available in full here:

http://github.com/comex/star

But is not well documented, that won’t stop the more advanced coders using it with malicious intents in mind.

Minutes after Apple issued a security update Wednesday, the maker of a 10-day-old jailbreak exploit released code that others could put to use hijacking iPhones, iPod Touches and iPads.

“Comex,” the developer of JailbreakMe 2.0, posted source code for the hacks that leveraged two vulnerabilities in iOS and allowed iPhone owners to install unauthorized apps. Apple patched the bugs earlier Wednesday.

The exploits that comex used to jailbreak the iOS could be used for other purposes, including delivering malicious payloads to grab control of iPhones, iPads, and iPod Touches. All that would be necessary is for hackers to dupe users into visiting a malicious Web site or persuading them to click on a link in an e-mail or text message. “Impressive. And dangerous,” said Mikko Hypponen , chief research officer at antivirus company F-Secure, on Twitter early today of the exploit code.

It may not be long before comex’s work is turned into a weapon for attacks that gain “root” access, or complete control, of iPhones and iPads.

This could be pretty dangerous, even though Apple has released a patch to address the issue – honestly how many people will apply the patch? And will they do it in a timely fashion? There’s always that window between the release and the majority of devices being secure that leaves things wide open to exploitation.

I’d be on the lookout for some serious malware to come out within the next week or so leveraging this method of exploitation. Could a large scale iPhone worm be the next big thing? I certainly think it’ll be more malicious that the previous rickrolling SSH bug. That was of course also followed up with a malicious iphone worm based on the same weakeness.

Noted Mac vulnerability researcher Dino Dai Zovi, co-author of The Mac Hackers Handbook , chimed in with a warning of his own. “Now that @comex released his jailbreak source, any bets on how long before it is ported to Metasploit?” Dai Zovi tweeted Wednesday.

Metasploit is the open-source penetration testing framework that some use as a hacking toolkit.

Apple did not patch 2007’s first-generation iPhone or iPod Touch yesterday, delivering the update only to the iPhone 3G or later running the iOS 2.0 or later, and to the second-generation iPod Touch or later running iOS 2.1 or later. Lacking patches, those early models may be vulnerable to attack.

Also possibly at risk: Mac OS X. Like iOS, Apple’s desktop operating system includes the FreeType font engine, which may be vulnerable to the same or a similar exploit.

And users who have used comex’s code to jailbreak their iPhones have a decision to make. If they accept Wednesday’s update, they lose the ability to install and run software not approved by Apple. But by ignoring the update, they may be victimized by future attacks based on the public code.

By making the code public comex has introduced a lot of interesting factors, does this exploit work on Mac OSX? Are older iOS devices vulnerable (because Apple has not released a patch for them)? What is going to come from this?

No-one can fault comex for his actions, he was offering a free solution for users to Jailbreak their devices and when Apple had patched the flaw he released the code.

Source: Network World

Posted in: Apple, Exploits/Vulnerabilities, Hacking Tools

, , ,


Latest Posts:


APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.


Comments are closed.