Researchers claim first iPhone vulnerability; exploit steals data, operates phone
Apple has until Aug. 2 to patch; after that, details go public at Black Hat
Computerworld - Three security researchers claimed Sunday that they have found the first exploitable vulnerability in Apple Inc.'s iPhone, a flaw that allows them to steal any data from the device or even to turn it into a remote surveillance tool.
The trio -- Charles Miller, formerly with the National Security Agency; Jake Honoroff; and Joshua Mason of Baltimore-based Independent Security Evaluators (ISE) -- have notified Apple of the vulnerability and given the company less than two weeks to fix the bug before Miller presents more information at the Black Hat conference on Aug. 2.
According to a paper posted by the three (download PDF), they rooted out a vulnerability in the iPhone's version of Safari using "fuzzing" tools and wrote a proof-of-concept exploit that can be delivered from a malicious Web site or using "man in the middle" tactics to trick users into connecting to a malicious wireless access point.
Once the exploit runs, it's essentially game over, the researchers said: The iPhone is owned. "In our proof of concept, this code reads the log of SMS messages, the address book, the call history and the voicemail data," the researchers wrote on the ISE site. "It then transmits all this information to the attacker."
But wait -- there's more!
That, however, could be just the beginning.
The researchers claimed that a second exploit actually operated the iPhone remotely once the device was hijacked. "When we viewed a second HTML page in our iPhone, it ran the second exploit payload which forced [the iPhone] to make a system sound and vibrate for a second," they said in the paper. "Alternately, by using other API functions we discovered, the exploit could have dialed phone numbers, sent text messages, or recorded audio (as a bugging device) and transmitted it over the network for later collection by a malicious party."
The vulnerability was reported to Apple last Tuesday, July 17. "We proposed a fix they could include in a future iPhone update," the researchers said, "but we don't know if they plan to do so. They responded and are looking into it."
In an e-mail late Sunday night, Apple spokeswoman Lynn Fox would only say: "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We're looking into the report submitted by I.S.E. and always welcome feedback on how to improve our security." She declined to answer questions about the Aug. 2 deadline, whether Apple would issue a patch before then, or what the company thought of the way the trio disclosed the vulnerability.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts