7 ms·

PDF exploit in iOS 4

79 points by andreyf 16y ago

antidaily 16y ago
So who's tried it?
- Lewisham 16y ago
  I have, it works fabulously. I needed to jailbreak my phone because the home button is broken, but couldn't use traditional means, as they required you to press the home button! This web-based one worked amazingly; you really do just visit the site, press "OK" and then three minutes later its done.
- ElbertF 16y ago
  I jailbroke my wife's phone (3G) a couple of days ago, the process was a breeze. I have to say the OS feels a bit sluggish now but that may have been caused by the update to 4.0.1.
  - Splines 16y ago
    Back when I had a jailbroken 3G running 3.something, it was noticeably slower. It ended up getting wiped by my 1 year old; I didn't re-jailbreak it and found it to be more performant. IMO, unless you really need an app that lives only in Cydia, it's not worth the hassle. Tethering is cool, but seems like something I would personally need 1% of the time.
- DanBlake 16y ago
  I did. Mainly for facetime over 3G, MyWi and theming options. Super easy to install and lets you actually patch (well, pseudo patch) this exploit.
- matthew-wegner 16y ago
  Jailbroke my new iPhone 4. I've been jailbreaking for years, although primarily to change my SMS sound (sad but true, and practically required in an office full of iPhones). I tether too, but only for conferences, which is pretty rare. I've been playing more with various apps since the iPhone 4 can certainly take the performance hit. SBSettings (swipe status bar to pull down commonly-used options, like toggling 3G/EDGE), LockInfo (put calendar, mail, weather, etc on your lock screen), BiteSMS (SMS replacement with a bunch of features).
- sjs 16y ago
  Worked perfectly on my iPhone 3GS. I was going to hold off on iOS 4 but I had to try this out. Easiest jailbreak yet, no computer required. It's awesome and scary. I really hope Apple gets a fix out soon.
Samuel_Michon 16y ago
Every time a new method for jailbreaking is announced, you know there must be an exploit in the OS. Apple will surely fix the exploit with an OS update, but as an effect customers won't be able to use jailbreak with that version. And so it becomes a question of whether you choose freedom or safety.
- rryyan 16y ago
  The jailbreak for iOS 1.1 based on the TIFF vulnerability also had a side-effect of patching the vulnerability itself[1] -- does jailbreak.me (or another party) do the same? [1] http://www.networkworld.com/news/2007/102907-iphone-ipod-touch-jailbreak-app.html http://www.networkworld.com/news/2007/102907-iphone-ipod-tou...
drivebyacct2 16y ago
Good thing Apple's review policy on the AppStore worked. (In case it's not immediately obvious, this is sarcastic in multi dimensions).
- rryyan 16y ago
  I know you're being sarcastic, but an exploit in iOS really doesn't have anything to do with Apple's review policy for 3rd party applications.
  - spinchange 16y ago
    A principle reason they give as a defense of their app review policy and walled garden approach is that it is necessary to protect users from bad or malicious apps. I think he's inferring (or pointing out the irony) that perhaps it's not the 3rd party ones they need to be so overly concerned with.
    - dman 16y ago
      The popularity of the jailbreaks suggests that apple might be underestimating the intelligence of their own users.
      - andreyf 16y ago
        I think Apple realizes the importance of the jailbreaking community (at least, some people at Apple do - do you doubt that 20 year old Steve Jobs would have jailbroken his phone?). I imagine they're simply uninterested in an arms race on that front.
        CamperBob 16y ago
        True; 20-year-old Steve Jobs was 'jailbreaking' the whole damn phone company (http://www.paulgraham.com/bluebox.html http://www.paulgraham.com/bluebox.html).
    - deleted 16y ago
cscotta 16y ago
It is good to see some analysis turning up on the exploit front. I was (and still am) surprised that the coverage of this jailbreak has been focused almost exclusively on the jailbreak itself rather than the attack vector and its implications. The fact that a zero-day remote code execution exploit can be triggered so reliably in every iOS 4 and iPad 3.x device that the creators could drop a cute "Slide to Jailbreak" widget on a web page is alarming. With nothing more than a single rogue link and a bit of Objective C, this exploit could easily be used to produce a worm spread by e-mail or SMS to every contact with a link to the same rogue code, hopping from device to device as users tap an innocent link from a friend. In fact, the action of clicking a link could be bypassed entirely by script injection -- resulting in infection should the user merely browse to a page serving the rouge JS. Considering that the exploit is PDF-based, it's likely that it could also be triggered by viewing a document in Mail. The prospect of iOS worms is very real, and unless Apple begins to take security more seriously (note that this is the second remote code execution exploit accessible from within MobileSafari, and they've yet to even make a peep about this one), I would not be surprised if we begin to see malware on the platform. [ See the original exploit teardown here: http://digdog.tumblr.com/post/894317027/jailbreak-with-pdf-flatedecode-filter http://digdog.tumblr.com/post/894317027/jailbreak-with-pdf-f... ]
- vinhboy 16y ago
  Yea I find it annoying that coverage is all about "jailbreaking". For gosh sake, they could use this and do drive-by looting of virtually any iPhone.
- tptacek 16y ago
  While I agree with your general take on the severity of the problem, I'm going to point out: * The teardown you've linked to is (a) pretty superficial and (b) wrong (though I see it's now been corrected) --- here I will annoy you by smugly noting that you've linked to an exploit teardown written by someone who thinks it's likely that the iPhone would have been vulnerable to an Acrobat Reader flaw. * It is not generally the impression I get from vulnerability researchers that the iPhone does a poorer job of defending against remote code execution vulnerabilities than Android; specifically: the iPhone has much stricter (DEP-style) page protections than OSX, and the iPhone has strict code signing. Does Apple need to take security seriously? Indubitably. But I don't think you can read tea leaves here. Things like this are going to happen to every phone. Let's see how Apple handles it; that, at least, is a signal we can actually discuss reasonably.
vinhboy 16y ago
Three days now, and no one figured it out yet... I want to know more... links, anyone?
DrJokepu 16y ago
So how do people know that this site doesn't install a rootkit that spies for credit card numbers or something similarly sinister? Why do they trust it? Because it looks "legit" or because it's in the news? Imagine something along the lines of: Clueless user: Wow this jailbreaking site really worked well! Now that it has finished, it's showing a Paypal donation button in my browser. It was really helpful so I'll just go ahead and donate $10 on Paypal, right here in the browser of my newly jailbroken phone... Author of the crack: [trollface.jpg] (thanks for the Paypal login details!)
- Lewisham 16y ago
  shrug Why do you trust anyone to do anything? Why do I trust AT&T not to be recording phone calls for the NSA (oh wait...) or Sony not to install rootkits on my Windows PC (hang on a second...). At the end of the day, unless it's open-source, the possibility of malicious intent is everywhere. It only takes one disgruntled/incompetent employee. That said, Gruber's last post on this indicated someone of repute had looked over the exploit, and they hadn't mentioned anything about such nastiness.
  - DrJokepu 16y ago
    To be fair, even open source is not an absolute guarantee for lack of malicious code, as proven by the absolutely brilliant Underhanded C Contest: http://underhanded.xcott.com/ http://underhanded.xcott.com/
    - uxp 16y ago
      Not only that, but combine some random code you don't really know about, and slightly less than stellar (aka average) security practices on the web and you might end up with a backdoor trojan implemented in your open source project: http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt
  - xycat 16y ago
    This argument is often put up for these kind of questions (the why trust anything you don't have control over), but there is a big difference from trusting a large corporation that might have to take responsibility and an obscure website. That being said I have a rooted/Custom ROM droid phone and I have no clue whether or not it is logging my keyboard or any such thing as I took the easy way of installing the root and rom, but that doesn't stop me from using it and I have to agree that if you want to wear a tinfoil hat that is fine and dandy just don't go against those who choose to go unprotected.
sev 16y ago
> "remote code exploit now in the wild" it's not just remote code exploit...it's privilege escalation, and that's no joke
jrockway 16y ago
Good thing Apple requires C, C++, and Objective-C. Good thing for crackers, I mean.

79 points by andreyf 16y ago

antidaily 16y ago

So who's tried it?

Lewisham 16y ago
I have, it works fabulously. I needed to jailbreak my phone because the home button is broken, but couldn't use traditional means, as they required you to press the home button! This web-based one worked amazingly; you really do just visit the site, press "OK" and then three minutes later its done.
ElbertF 16y ago
I jailbroke my wife's phone (3G) a couple of days ago, the process was a breeze. I have to say the OS feels a bit sluggish now but that may have been caused by the update to 4.0.1.
- Splines 16y ago
  Back when I had a jailbroken 3G running 3.something, it was noticeably slower. It ended up getting wiped by my 1 year old; I didn't re-jailbreak it and found it to be more performant. IMO, unless you really need an app that lives only in Cydia, it's not worth the hassle. Tethering is cool, but seems like something I would personally need 1% of the time.
DanBlake 16y ago
I did. Mainly for facetime over 3G, MyWi and theming options. Super easy to install and lets you actually patch (well, pseudo patch) this exploit.
matthew-wegner 16y ago
Jailbroke my new iPhone 4. I've been jailbreaking for years, although primarily to change my SMS sound (sad but true, and practically required in an office full of iPhones). I tether too, but only for conferences, which is pretty rare. I've been playing more with various apps since the iPhone 4 can certainly take the performance hit. SBSettings (swipe status bar to pull down commonly-used options, like toggling 3G/EDGE), LockInfo (put calendar, mail, weather, etc on your lock screen), BiteSMS (SMS replacement with a bunch of features).
sjs 16y ago
Worked perfectly on my iPhone 3GS. I was going to hold off on iOS 4 but I had to try this out. Easiest jailbreak yet, no computer required. It's awesome and scary. I really hope Apple gets a fix out soon.

Samuel_Michon 16y ago

Every time a new method for jailbreaking is announced, you know there must be an exploit in the OS. Apple will surely fix the exploit with an OS update, but as an effect customers won't be able to use jailbreak with that version. And so it becomes a question of whether you choose freedom or safety.

rryyan 16y ago
The jailbreak for iOS 1.1 based on the TIFF vulnerability also had a side-effect of patching the vulnerability itself[1] -- does jailbreak.me (or another party) do the same? [1] http://www.networkworld.com/news/2007/102907-iphone-ipod-touch-jailbreak-app.html http://www.networkworld.com/news/2007/102907-iphone-ipod-tou...

drivebyacct2 16y ago

Good thing Apple's review policy on the AppStore worked. (In case it's not immediately obvious, this is sarcastic in multi dimensions).

rryyan 16y ago
I know you're being sarcastic, but an exploit in iOS really doesn't have anything to do with Apple's review policy for 3rd party applications.
- spinchange 16y ago
  A principle reason they give as a defense of their app review policy and walled garden approach is that it is necessary to protect users from bad or malicious apps. I think he's inferring (or pointing out the irony) that perhaps it's not the 3rd party ones they need to be so overly concerned with.
  - dman 16y ago
    The popularity of the jailbreaks suggests that apple might be underestimating the intelligence of their own users.
    - andreyf 16y ago
      I think Apple realizes the importance of the jailbreaking community (at least, some people at Apple do - do you doubt that 20 year old Steve Jobs would have jailbroken his phone?). I imagine they're simply uninterested in an arms race on that front.
      - CamperBob 16y ago
        True; 20-year-old Steve Jobs was 'jailbreaking' the whole damn phone company (http://www.paulgraham.com/bluebox.html http://www.paulgraham.com/bluebox.html).
  - deleted 16y ago

cscotta 16y ago

It is good to see some analysis turning up on the exploit front. I was (and still am) surprised that the coverage of this jailbreak has been focused almost exclusively on the jailbreak itself rather than the attack vector and its implications. The fact that a zero-day remote code execution exploit can be triggered so reliably in every iOS 4 and iPad 3.x device that the creators could drop a cute "Slide to Jailbreak" widget on a web page is alarming. With nothing more than a single rogue link and a bit of Objective C, this exploit could easily be used to produce a worm spread by e-mail or SMS to every contact with a link to the same rogue code, hopping from device to device as users tap an innocent link from a friend. In fact, the action of clicking a link could be bypassed entirely by script injection -- resulting in infection should the user merely browse to a page serving the rouge JS. Considering that the exploit is PDF-based, it's likely that it could also be triggered by viewing a document in Mail. The prospect of iOS worms is very real, and unless Apple begins to take security more seriously (note that this is the second remote code execution exploit accessible from within MobileSafari, and they've yet to even make a peep about this one), I would not be surprised if we begin to see malware on the platform. [ See the original exploit teardown here: http://digdog.tumblr.com/post/894317027/jailbreak-with-pdf-flatedecode-filter http://digdog.tumblr.com/post/894317027/jailbreak-with-pdf-f... ]

vinhboy 16y ago
Yea I find it annoying that coverage is all about "jailbreaking". For gosh sake, they could use this and do drive-by looting of virtually any iPhone.
tptacek 16y ago
While I agree with your general take on the severity of the problem, I'm going to point out: * The teardown you've linked to is (a) pretty superficial and (b) wrong (though I see it's now been corrected) --- here I will annoy you by smugly noting that you've linked to an exploit teardown written by someone who thinks it's likely that the iPhone would have been vulnerable to an Acrobat Reader flaw. * It is not generally the impression I get from vulnerability researchers that the iPhone does a poorer job of defending against remote code execution vulnerabilities than Android; specifically: the iPhone has much stricter (DEP-style) page protections than OSX, and the iPhone has strict code signing. Does Apple need to take security seriously? Indubitably. But I don't think you can read tea leaves here. Things like this are going to happen to every phone. Let's see how Apple handles it; that, at least, is a signal we can actually discuss reasonably.

vinhboy 16y ago

Three days now, and no one figured it out yet... I want to know more... links, anyone?

DrJokepu 16y ago

So how do people know that this site doesn't install a rootkit that spies for credit card numbers or something similarly sinister? Why do they trust it? Because it looks "legit" or because it's in the news? Imagine something along the lines of: Clueless user: Wow this jailbreaking site really worked well! Now that it has finished, it's showing a Paypal donation button in my browser. It was really helpful so I'll just go ahead and donate $10 on Paypal, right here in the browser of my newly jailbroken phone... Author of the crack: [trollface.jpg] (thanks for the Paypal login details!)

Lewisham 16y ago
shrug Why do you trust anyone to do anything? Why do I trust AT&T not to be recording phone calls for the NSA (oh wait...) or Sony not to install rootkits on my Windows PC (hang on a second...). At the end of the day, unless it's open-source, the possibility of malicious intent is everywhere. It only takes one disgruntled/incompetent employee. That said, Gruber's last post on this indicated someone of repute had looked over the exploit, and they hadn't mentioned anything about such nastiness.
- DrJokepu 16y ago
  To be fair, even open source is not an absolute guarantee for lack of malicious code, as proven by the absolutely brilliant Underhanded C Contest: http://underhanded.xcott.com/ http://underhanded.xcott.com/
  - uxp 16y ago
    Not only that, but combine some random code you don't really know about, and slightly less than stellar (aka average) security practices on the web and you might end up with a backdoor trojan implemented in your open source project: http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt
- xycat 16y ago
  This argument is often put up for these kind of questions (the why trust anything you don't have control over), but there is a big difference from trusting a large corporation that might have to take responsibility and an obscure website. That being said I have a rooted/Custom ROM droid phone and I have no clue whether or not it is logging my keyboard or any such thing as I took the easy way of installing the root and rom, but that doesn't stop me from using it and I have to agree that if you want to wear a tinfoil hat that is fine and dandy just don't go against those who choose to go unprotected.

sev 16y ago

> "remote code exploit now in the wild" it's not just remote code exploit...it's privilege escalation, and that's no joke

jrockway 16y ago

Good thing Apple requires C, C++, and Objective-C. Good thing for crackers, I mean.