10 ms·

IPhone hacked via Mobile Safari and SMS database hijacked (at Pwn2Own 2010)

• kvs 17y ago
  Note that this is not a jail-broken iPhone. This is a regular iPhone with latest OS with code signing.
  • DougBTX 17y ago
    I enjoy the idea of return oriented programming, piecing together an exploit from your host app's binary. Worth noting that they didn't break out of the sandbox, an app downloaded from the App Store could get access to the same data they did.
    • tptacek 17y ago
      Did they ROP the iPhone, or was is a straight-up ret2libc? Ret2libc is an ancient technique.
      • DougBTX 17y ago
        More details here http://blog.zynamics.com/ http://blog.zynamics.com/ tomorrow - doesn't sound like it is straight up, depends what they mean by "chained".
        • tptacek 17y ago
          Ok, it sounds like Halvar is just rejecting the term ROP, and you're right, that's what it is.
• tptacek 17y ago
  It's news, and it's noteworthy, but I think the IE8 flaw Vreugdenhill used is a bigger deal: http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-InternetExplorer8.pdf http://vreugdenhilresearch.nl/Pwn2Own-2010-Windows7-Internet...
• memoryfault 17y ago
  Not so much hijacked as it was downloaded to the server...
• jrockway 17y ago
  But hey, at least Apple saved a few bounds checks before memory writes!
• JunkDNA 17y ago
  I almost skipped this article assuming it was one of these "hacks that's not a hack" kind of things. This is a pretty major security issue, especially since the hack is claimed to potentially expose email as well. The Exchange server integration means some pretty sophisticated phishing could be done to get access to confidential info. Hope Apple patches this flaw fast.