5 ms·

> Image files are an excellent vector for attacks since they can be easily distributed over web ... Reminds me of how easy it was to jailbreak the first iPhone

> Image files are an excellent vector for attacks since they can be easily distributed over web ... Reminds me of how easy it was to jailbreak the first iPhone (in 2007) with a malicious image. No computer required. - Use a quick hack to enable WiFi on a brand new unactivated phone (for which you just paid full price). - Visit a website with a malicious tiff file, Voila ! The best part : The above jailbreak also claimed that they patched the vulnerability after exploiting it. http://www.computerworld.com/article/2539680/security0/new-iphone--ipod-touch--jailbreak--app-patches-critical-tiff-bug.html http://www.computerworld.com/article/2539680/security0/new-i...

madeofpalk 10y ago
> brand new unactivated phone (for which you just paid full price). Still can't believe the fact that they let people walk away with a subsidised phone without a contract to ensure they'll recoup the price.
- inertial 10y ago
  > Still can't believe the fact that they let people walk away with a subsidised phone Did they ? The cheapest one was $599 initially. I don't feel that's the price of a subsidized phone. After a few months the price was dropped by $200, but that was to accelerate sales and capture a bigger market share. Their pricing & sales model was unconventional, both for AT&T as well as customers, because the device was unique in so many ways back then.
- mikestew 10y ago
  I'm lost. Between the parentheses it says one has paid "full price", and therefore unsubsidized (or so I would assume if I paid the full retail price for a phone).
  - UweSchmidt 10y ago
    "This is how I used lockpicks to open the door. Then I proceeded to NOT enter the house as this would be a crime."
mikeash 10y ago
And again around iOS 4. Visit jailbreak.me in the browser and, pow, done. Good times.
- qwertyuiop924 10y ago
  But that was a PDF vuln. Not an image vuln.
  - mikeash 10y ago
    PDF is more or less an image format, and certainly in this context it serves the exact same purpose: visit web site, get served a file which exploits the browser and performs the jailbreak.
    - qwertyuiop924 10y ago
      Fair 'nuff.

madeofpalk 10y ago

> brand new unactivated phone (for which you just paid full price). Still can't believe the fact that they let people walk away with a subsidised phone without a contract to ensure they'll recoup the price.

inertial 10y ago
> Still can't believe the fact that they let people walk away with a subsidised phone Did they ? The cheapest one was $599 initially. I don't feel that's the price of a subsidized phone. After a few months the price was dropped by $200, but that was to accelerate sales and capture a bigger market share. Their pricing & sales model was unconventional, both for AT&T as well as customers, because the device was unique in so many ways back then.
mikestew 10y ago
I'm lost. Between the parentheses it says one has paid "full price", and therefore unsubsidized (or so I would assume if I paid the full retail price for a phone).
- UweSchmidt 10y ago
  "This is how I used lockpicks to open the door. Then I proceeded to NOT enter the house as this would be a crime."

mikeash 10y ago

And again around iOS 4. Visit jailbreak.me in the browser and, pow, done. Good times.

qwertyuiop924 10y ago
But that was a PDF vuln. Not an image vuln.
- mikeash 10y ago
  PDF is more or less an image format, and certainly in this context it serves the exact same purpose: visit web site, get served a file which exploits the browser and performs the jailbreak.
  - qwertyuiop924 10y ago
    Fair 'nuff.