4 ms·
As people commented on Reddit, this is not significantly different from any jailbreak using a computer. This is USB we are talking about, and the malicious char
by adlpz 13y ago
As people commented on Reddit, this is not significantly different from any jailbreak using a computer. This is USB we are talking about, and the malicious charger in this case is a full-featured Linux computer.
So yes, they are installing unsigned software through USB on an iPhone by plugging it into a USB socket in a computer. That is just normal jailbreaking, and has been done forever, isn't it?
- caseysoftware 13y agoI think the big difference here is that people willingly plug their phones into the airport kiosk chargers, share chargers, use car-based usb plugs, and generally don't even think of it as an attack vector. On another note, I've been amazed by the number of people who let others plug phones into their computer for a quick charge. I'll let people borrow my wall charger if I'm sitting there but no one plugs anything into my computer.
- deleted 13y ago[deleted]
- unimpressive 13y ago>no one plugs anything into my computer. I believe the same, including vice versa for that matter. (That is, I would never plug a phone into somebodies computer.)
- jonknee 13y agoI believe "normal" jailbreaking requires the phone to be unlocked. This works without any user action. When the phone is locked everything is supposed to be encrypted and secured.
- meowface 13y agoI'm unfamiliar with the exact process of jailbreaking; if a phone is unlocked but plugged into a separate computer, you can essentially run arbitrary code on the phone if you are controlling the computer it's connected to?
- adlpz 13y agoNot really, in fact I believe some methods even reboot the system into a recovery mode without any user interaction, so given a vulnerability, there are definitely ways of interacting with the phone without it being unlocked.
- jonknee 13y agoBut do they start that process with it being locked? It's one thing to inject code while unlocked and another to take control of a locked phone.
- adlpz 13y agoThe whole locked phone thing is just a graphical and OS feature. If the OS is vulnerable to a remote injection it might just as easily bypass the locked state.
- pudquick 13y agoThank you for pointing this out. The researchers are using a Beagleboard device for the exploit. Based on what they've said to the press so far, it sounds like a no-interaction tethered jailbreak (if it's truly functional on all Apple devices) or at best an untethered jailbreak on limited Apple devices. If this presentation is claiming the ability to install software on ALL non-jailbroken Apple devices running the latest OS version that survives a reboot of the device (once it's detached from the charger), then that's potentially worth more than any "malicious USB charger" talk (since the jailbreak community is currently unable to to do this).
- mrmekon 13y agoDock speakers connect to the iphone through the same interface. The high end ones have ARM cores, they have wifi, they might even run Linux. There is a theoretical chain of trojan --internet--> PC --wifi--> speaker --usb--> iphone. This is, of course, insanely unlikely today. But in a few years, when everything has a 1GHz ARM core and an internet connection, we very well might start seeing malware that jumps devices and infects entire households.