“A team of computer security consultants say they have found a flaw in Apple’s wildly popular iPhone that allows them to take control of the device,” John Schwartz reports for The New York Times.
“The researchers, working for Independent Security Evaluators, a company that tests its clients’ computer security by hacking it, said that they could take control of iPhones through a WiFi connection or by tricking users into going to a Web site that contains malicious code. The hack, the first reported, allowed them to tap the wealth of personal information the phones contain,” Schwartz reports.
“Although Apple built considerable security measures into its device, said Charles A. Miller, the principal security analyst for the firm, ‘Once you did manage to find a hole, you were in complete control.’ The firm, based in Baltimore, alerted Apple about the vulnerability this week and recommended a software patch that could solve the problem,” Schwartz reports.
Schwartz reports, “A spokeswoman for Apple, Lynn Fox, said, ‘Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We’re looking into the report submitted by I.S.E. and always welcome feedback on how to improve our security,’ she said. There is no evidence that this flaw had been exploited or that users had been affected.”
“The Independent Security Evaluators researchers were able to crack the phone’s software in a week, said Aviel D. Rubin, the firm’s founder and the technical director of the Information Security Institute at Johns Hopkins University. Mr. Rubin, who bought an iPhone the day after the cellphone was released, said in an interview that he had approached three colleagues, Dr. Miller, Joshua Mason and Jake Honoroff, and offered them an enticing prize if they would try to crack the iPhone. ‘I told the guys I would buy them iPhones,'” Schwartz reports.
Schwartz reports, “Mr. Rubin said, ‘I will think twice before getting on a random public WiFi network now,’ but his overall opinion of the phone has not changed. ‘You’d have to pry it out of my cold, dead hands to get it away from me,’ he said.”
More details in the full article here.
“Researchers at my consulting company, Independent Security Evaluators (ISE) have found serious security vulnerabilities in the iPhone. They were able to take complete control of the iPhone device and run arbitrary shell code (see NYT article). To demonstrate this, they built an exploit that downloads personal information such as SMS text transcripts, address book entries, and email from the iPhone whenever a user visits a particular web site or connects to a particular WiFi network. However, the vulnerability can be exploited in many other ways. For example, an exploit could be written that would cause the iPhone to make an unnoticeable phone call to an attacker, who would then be able to monitor conversations by the victim. In other words, the iPhone could be turned into a bugging device,” Avi Rubin blogs.
“We contacted Apple on July 17 and sent them all of the details of the vulnerability. We also promised not to release any specific technical details of the vulnerability that would allow someone else to exploit it until our Black Hat presentation on August 2. This gave them plenty of time to produce a fix, and we showed Apple how to patch the vulnerability,” Rubin writes.
Full blog entry here.
More info via “Independent Security Evaluators” here.
[Thanks to MacDailyNews Readers “Fred Mertz” and “TowerTone” and “doc” for the heads up.]
While we strongly disagree with the “Security via Obscurity/Microsoft Apologists*” thesis presented in The NY Times’ full article, anyone helping locate potential security issues and allowing Apple to correct them with updates before end-users are affected should be applauded, if indeed that is the case here.
Of possible related interest, on Saturday The Associated Press carried an article by Anick Jesdanun that reported, “For some security researchers who uncover flaws in leading computer programs, a nod of appreciation from software companies is no longer enough. Now they want money.”
Jesdanun reported, “Charlie Miller, now the principal security analyst at Independent Security Evaluators, said the demands for payments stem from frustrations that vendors’ in-house researchers ‘are making a lot of money to look for bugs and whenever someone from the outside finds something, they don’t get paid anything.'”
Jesdanun reported, “But Miller, after trying to sell two separate vulnerabilities himself including the $50,000 one to the government, concluded it wasn’t worth the trouble. He said it was difficult identifying potential buyers, and in one case the vendor had fixed the problem before he could complete the sale. ‘I would have loved to start a business out of it,’ he said. ‘One of the lessons I learned is that it’s impossible to do that.'”
Full article here.
*There are zero-percent (0%) of viruses for the Mac OS X platform that should, logically, have some 10-16% of the world’s viruses if platforms’ install bases dictate the numbers of viruses. The fact that Mac OS X has zero (0) viruses in the wild totally discounts “security via obscurity.” 23+ million Mac OS X installs is not an “obscure” platform at all, but 6+ years of Mac OS X users surfing unimpeded certainly is “secure.” There should be at least some Mac OS X viruses. There are none. The reason for this fact is not attributable solely to ‘obscurity,’ it’s attributable to superior security design.
I know a fool proof way to take control of, and tap into the wealth of personal information on any other person’s iPhone. Steal one and plug it into my iPhone dock.
Glad to hear Independent Security Evaluators is doing the right thing and working with Apple.
Peace.
‘You’d have to pry it out of my cold, dead hands to get it away from me,’ he said.”
says it all
I’m no security expert, but I am having a hard time believing this is for real. After reading this article I find their claims—such as making the iPhone make unsolicited calls—hard to believe. I guess only time will tell. But my initial reaction is to cry FUD.
@Tommy Boy
For password-protected iPhones, that only works with the computer that activated the phone.
stuff gets hacked. iPhones too.
I remember a time when the readers on here used to complain about all the iPod stories on here.
it’s pretty obvious the iPhone is the new iPod… lol.
Pay close attention to the “iPhone” in their video; note that it has buttons on the right-hand side and a large black protrusion below the crown.
Note also that the shadow it casts is as long, or longer, than that cast by the roll of tape to the right.
On a real iPhone, the buttons are on the left, and there is no such protrusion. A real iPhone is also much thinner than that roll of tape, and oriented as in the video you can see the silver backplate up the right side.
Clearly, this video does not depict an iPhone. It is more likely to be one of the knock-offs that have been doing the rounds, in which case the “demonstration” is a movie of some sort.
Whilst this doesn’t say anything one way or another about the actuality of the exploit, it does beg the question: if these folks have a real exploit, why are they faking their demo?
Now imagine if Apple had unleashed an SDK for developers to make 3rd party apps; how much more difficult would it be for Apple to deal with all the security ramifications? Glad to hear the ISE is working with Apple and not exploiting them. I’m sure Apple will respond very quickly as this is paramount to their reputation, and once all the basic security threats are dealt with (things are stable), they will eventually open the phone up to app developers.
If this is true, I’m glad that the researchers at ISE are doing things the right way.
This is not to say that the exploit is true, since we still have to read a confirmation from Apple, but for them to give Apple the time to study the supposed flaws and provide a fix for it is surely admirable. Responsible disclosure it is.
Again, if this is true, Apple should release a security update for it and we’ll all be back to stardom. Well, not really me though since I won’t have an iPhone at least until 2008… arrgghh.
MDN word for the day, “patience”. as in my patience is running out
“There are zero-percent (0%) of viruses for the Mac OS X platform that should, logically, have some 10-16% of the world’s viruses if platforms’ install bases dictate the numbers of viruses.”
I agree that all the flannel about OS market-share amounts to little more than unproved assertion. It may be true – or, more credibly, it may be one factor – but there’s no evidence it’s the be-all and end-all. And, in fact, there’s some evidence that it isn’t. For example, there was malware around for the old Mac OS, which unlike OS X was not Unix-based, even though its market-share was not high. And this was likely *because* it did not have the superior Unix-based architecture.
However, I don’t think that what MDN says is logically entailed by the claim that installed base is relevant. David Pogue has claimed this, too, but I think it’s a canard. Malware doesn’t arise by some spontaneous natural process but out of economic calculation. (These days selling compromised machines is big business.) Therefore, there is no reason why percentage of installed base and percentage of malware should be in direct proportion. It is, however, conceivable that, assuming programming for a target platform takes an equivalent length of time for any platform (a big if), it’s not worth the time to write malware for a platform *at all* unless its share is pretty substantial, since the economic payoff (in terms of the commercial value on the black market of the numbers of machines likely to be caught) is going to be lower.
So I don’t agree with MDN’s line of reasoning there. However, as I say, I do agree with MDN’s overall point. AFAICT there’s no real evidence that installed base is the *only* factor. That’s just unproven assertion.
@Mark 1 Eyeball
Okay, I’ll bite. Where’s the video. NYTimes doesn’t have one up. Avi’s blog doesn’t show a link, either. At least not one that I can find.
Are you really Avi trying to shoo traffic to your blog? You are, aren’t you?
” width=”19″ height=”19″ alt=”wink” style=”border:0;” />
Yep, here they come. OSX is the swiss cheese of security and we get to see the total incompetence of Apple computer. Of course there are problems, Apple doesn’t know how to design a phone. Too bad for the boobs that handed $2k to ATT and Apple for a piece of junk that allows hackers to steal all the user’s data.
There is a word for people that buy junk like this – sucker!
@mr
LOL!
The aforementioned video is here, on ISE’s site: http://www.securityevaluators.com/iphone/
This may confirm the security via obscurity theory. The Mac still doesn’t show up on the radar of most hackers however the iPhone is on everyone’s radar and makes a far more tempting target.
It’ll be interesting to see how often the iPhone is successfully hacked over the next year.
Maybe this will prove, one way or another, whether OSX is indeed more secure.
I wish just one person in the world would look up the actual meaning of the word ‘hacker’. If someone uses an iPhone to navigate to a web site and hand the site owner the keys, it has not been hacked. But then, that would require a little depth of thought and that sort of thing never makes good headlines for bite-sized bottom feeders. Well here’s one for ya…
Life Imitates Fox News!
bla blah bal in a lab blah blah
with the device in our hand … blah blah blah
team with free iphone as the prize bla blah blah
If you are dumb enough to keep your dob, ssn and credit card info on a iPhone then what can you expect. What, do you keep a file that reads “For Hackers Only!”
I agree that the there is something bogus about the iPhone in the video. It’s too thick. And what’s with the pretzel and post-it notes. Do we really need size references to demonstrate and software vulnerability. Someone was trying TOO hard to imply this was a real iPhone. Even so, I wouldn’t be surprised, or even overly alarmed, to learn that this exploit is absolutely on the level. Whenever you join a network you’ve allowed others on that network access to your computer that they would not normally have. This is not the same level of vulnerability that made Windows infamous.
@C1– Come on, why the Fox News dig? The article was published in the NYT.
I wasn’t talking about NYT, I was talking about the propensity for using the word ‘hack’ in a knee-jerk fashion.
Currently on the front page of Foxnews.com
“Is your cell phone making you fat?”
“Is your cell phone making you fat?”:
Answer: Apparently so. I’ve gained two pounds since acquiring my iPhone.
NY Slimes, liberal loving, commie rag.
ChrissyOne and I like to butch it up!
…and the intellectual feast begins.