What it took to hack the iPhone

iPhone vulnerability also exists in Mac OS X

The iPhone vulnerability that could let hackers steal data or commandeer the device also exists in the desktop edition of Apple's Mac OS X operating system, the exploit's researchers said Tuesday.

Charles Miller, one of the three researchers from Baltimore-based Independent Security Evaluators (ISE) who found the bug and wrote proof-of-concept exploits, confirmed that the vulnerability in the iPhone version of Safari is also present in the desktop version of the browser. Safari is included with all Mac OS X installations.

The Windows version of Safari is also vulnerable. "[But] it may or may not be exploitable there," Miller said.

Miller, Jake Honoroff and Joshua Mason found the Safari flaw using what Miller described as "fuzzing" techniques. Fuzzing, a tactic commonly used by vulnerability researchers, drops random data into applications or operating system components to see if -- and where -- breakdowns occur. Typically, the process is automated with a fuzzer, software that hammers on application inputs.

Not that the iPhone made it easy. The lack of debugger, for example, required that Miller and the others turn to alternatives, including the Mac OS X crash reporter, which logs all crashes, for ways to probe the iPhone. "The crash reports contained the contents of registers and what libraries were loaded," giving the team some clues, Miller said. Others they gleaned by examining the phone's core applications, which they could pull off the device only using iPhoneInterface. That program, part of the results of a group effort at the iPhone Dev Wiki, lets researchers and hackers modify the phone.

"Between the crash reports and the core files, we had a good picture of the application when it crashed," said Miller. "We found a few crashes that stuck out from the rest."

With iPhoneInterface and another program named Jailbreak -- Miller called them "hacking tools" -- the three researchers were able to pull Safari off the iPhone, disassemble it on a Mac desktop machine, and modify it so that would crash at the code location where the researchers wanted. "It was trial and error," Miller admitted. Testing required the application to be returned to the iPhone, where it was run, generating another crash report.

"It was like 'fuzzing' for an exploit," said Miller.

Although the three are withholding details until Aug. 2, when Miller will reveal more at the Black Hat security conference, one security expert is betting that the Safari vulnerability is a buffer overflow bug. "The methods and results described [by the ISE researchers] hint at a buffer overflow," said Andrew Storms, director of security operations at nCircle Network Security Inc. "But it's not entirely clear if they were intentionally crashing the application to get crash dumps to disassemble the code and look for flaws in general, or if the application crashed due to being fuzzed and hence the fuzzing activity reveled the bug."

Although their work was time-consuming, Miller doesn't see it as rocket science. Where they went, others will soon follow, he said. "The vulnerability was there, no harder to find than any other. We didn't do anything that was clever," he explained.

Apple may disagree if it's not able to issue a fix before the Aug. 2 Black Hat presentation. ISE reported its findings to the computer maker a week ago, on July 17, giving Apple just 16 days to patch Safari. "We gave them a patch," Miller said. "All they have to do it put it with an update." However, when contacted by Computerworld on Saturday, Apple spokeswoman Lynn Fox declined to say whether Apple would issue a patch in time.

Other iPhone applications may contain vulnerabilities as well, Miller warned. A Safari patch may not be the end of the device's troubles.

But would he give up his new iPhone? Not hardly. "It's like any other computer," he said. "As long as you're careful about the sites you visit and know what wireless access point you're connecting to, you should be safe."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?