5 ms·

"The genius of the iPad is that it cannot get things like viruses." safari can certainly be compromised, but even with the sandboxing that claim seems like a s

by hubb 17y ago

"The genius of the iPad is that it cannot get things like viruses." safari can certainly be compromised, but even with the sandboxing that claim seems like a stretch

fossguy 17y ago
It will be way less common, specialy considering that you can't execute anything in there...
- daeken 17y ago
  That's a very, very silly idea. If the device can be jailbroken by browsing a webpage that exploits a vulnerability in the browser, such a page could also infect your device. The idea that the iPhone/iPod touch/iPad are any less vulnerable to viruses than any other networked device out there is just plain wrong. People can and will attack these devices, it's just a matter of how difficult it is; from my experience with auditing Apple's products, the difficulty level is generally somewhere between trivial and damn-near-trivial.
  - derefr 17y ago
    The difference is that fixing an iPad won't require a repair shop; it'll require plugging it into your computer, which will go through its normal syncing cycle of backing it up, then upgrading apps—but it'll notice the invalid app checksums on infected apps and overwrite them with App-Store-canonical versions. If kernel-level viruses become prevalent, it'll simply start checksumming that too, and offering to restore from an IPSW with all your data (but nome of your config) intact (but that won't be a problem, since part of Apple's aesthetic is "low configuration.") Interestingly, it'll mean that only jailbreakers—and those with no access to a computer to sync with—will ever have viruses for more than one sync cycle.
- ay 17y ago
  But given a sufficiently complex code, you can execute from unexpected places. Sometimes even without any bugs involved: http://blog.didierstevens.com/2010/03/29/escape-from-pdf/ http://blog.didierstevens.com/2010/03/29/escape-from-pdf/
misuba 17y ago
One thing's for sure, if iPhone-like computers get more significant uptake, we will find out exactly how horrible XSS can be.
johnl87 17y ago
that almost sounds like a challenge
protomyth 17y ago
I am sure there will be security problems, but the basic starting point seems like it should make things easier to deal with. Every app is in a jail with limited access. I am curious how the common file area plays into security.
Calamitous 17y ago
This challenge sounds like an excellent way to be rapidly educated about a broad array of security holes.
leviathant 17y ago
Yeah, that line really stuck out to me. Wasn't there a link floating around in the last week or so where people were able to utilize some kind of bug in the iPhone to extract the entire database of SMS texts, including previously deleted SMS messages?

by hubb 17y ago

"The genius of the iPad is that it cannot get things like viruses." safari can certainly be compromised, but even with the sandboxing that claim seems like a stretch

fossguy 17y ago

It will be way less common, specialy considering that you can't execute anything in there...

daeken 17y ago
That's a very, very silly idea. If the device can be jailbroken by browsing a webpage that exploits a vulnerability in the browser, such a page could also infect your device. The idea that the iPhone/iPod touch/iPad are any less vulnerable to viruses than any other networked device out there is just plain wrong. People can and will attack these devices, it's just a matter of how difficult it is; from my experience with auditing Apple's products, the difficulty level is generally somewhere between trivial and damn-near-trivial.
- derefr 17y ago
  The difference is that fixing an iPad won't require a repair shop; it'll require plugging it into your computer, which will go through its normal syncing cycle of backing it up, then upgrading apps—but it'll notice the invalid app checksums on infected apps and overwrite them with App-Store-canonical versions. If kernel-level viruses become prevalent, it'll simply start checksumming that too, and offering to restore from an IPSW with all your data (but nome of your config) intact (but that won't be a problem, since part of Apple's aesthetic is "low configuration.") Interestingly, it'll mean that only jailbreakers—and those with no access to a computer to sync with—will ever have viruses for more than one sync cycle.
ay 17y ago
But given a sufficiently complex code, you can execute from unexpected places. Sometimes even without any bugs involved: http://blog.didierstevens.com/2010/03/29/escape-from-pdf/ http://blog.didierstevens.com/2010/03/29/escape-from-pdf/

misuba 17y ago

One thing's for sure, if iPhone-like computers get more significant uptake, we will find out exactly how horrible XSS can be.

johnl87 17y ago

that almost sounds like a challenge

protomyth 17y ago

I am sure there will be security problems, but the basic starting point seems like it should make things easier to deal with. Every app is in a jail with limited access. I am curious how the common file area plays into security.

Calamitous 17y ago

This challenge sounds like an excellent way to be rapidly educated about a broad array of security holes.

leviathant 17y ago

Yeah, that line really stuck out to me. Wasn't there a link floating around in the last week or so where people were able to utilize some kind of bug in the iPhone to extract the entire database of SMS texts, including previously deleted SMS messages?