Apple just released a patch for iOS that fixes the vulnerability that was being used by JailbreakMe website to exploit a weakness in PDF handling to Jailbreak the device.
Shortly after that the developer of the JailbreakMe exploit released the code to the public via GitHub. The code is available in full here:
But is not well documented, that won’t stop the more advanced coders using it with malicious intents in mind.
Minutes after Apple issued a security update Wednesday, the maker of a 10-day-old jailbreak exploit released code that others could put to use hijacking iPhones, iPod Touches and iPads.
“Comex,” the developer of JailbreakMe 2.0, posted source code for the hacks that leveraged two vulnerabilities in iOS and allowed iPhone owners to install unauthorized apps. Apple patched the bugs earlier Wednesday.
The exploits that comex used to jailbreak the iOS could be used for other purposes, including delivering malicious payloads to grab control of iPhones, iPads, and iPod Touches. All that would be necessary is for hackers to dupe users into visiting a malicious Web site or persuading them to click on a link in an e-mail or text message. “Impressive. And dangerous,” said Mikko Hypponen , chief research officer at antivirus company F-Secure, on Twitter early today of the exploit code.
It may not be long before comex’s work is turned into a weapon for attacks that gain “root” access, or complete control, of iPhones and iPads.
This could be pretty dangerous, even though Apple has released a patch to address the issue – honestly how many people will apply the patch? And will they do it in a timely fashion? There’s always that window between the release and the majority of devices being secure that leaves things wide open to exploitation.
I’d be on the lookout for some serious malware to come out within the next week or so leveraging this method of exploitation. Could a large scale iPhone worm be the next big thing? I certainly think it’ll be more malicious that the previous rickrolling SSH bug. That was of course also followed up with a malicious iphone worm based on the same weakeness.
Noted Mac vulnerability researcher Dino Dai Zovi, co-author of The Mac Hackers Handbook , chimed in with a warning of his own. “Now that @comex released his jailbreak source, any bets on how long before it is ported to Metasploit?” Dai Zovi tweeted Wednesday.
Metasploit is the open-source penetration testing framework that some use as a hacking toolkit.
Apple did not patch 2007’s first-generation iPhone or iPod Touch yesterday, delivering the update only to the iPhone 3G or later running the iOS 2.0 or later, and to the second-generation iPod Touch or later running iOS 2.1 or later. Lacking patches, those early models may be vulnerable to attack.
Also possibly at risk: Mac OS X. Like iOS, Apple’s desktop operating system includes the FreeType font engine, which may be vulnerable to the same or a similar exploit.
And users who have used comex’s code to jailbreak their iPhones have a decision to make. If they accept Wednesday’s update, they lose the ability to install and run software not approved by Apple. But by ignoring the update, they may be victimized by future attacks based on the public code.
By making the code public comex has introduced a lot of interesting factors, does this exploit work on Mac OSX? Are older iOS devices vulnerable (because Apple has not released a patch for them)? What is going to come from this?
No-one can fault comex for his actions, he was offering a free solution for users to Jailbreak their devices and when Apple had patched the flaw he released the code.
Source: Network World