4 ms·
> It turns out that any device you connect with an iOS via the USB port can obtain your device's Universal Device ID (UDID), as long as the device isn't passcod
by joshuahedlund 13y ago
> It turns out that any device you connect with an iOS via the USB port can obtain your device's Universal Device ID (UDID), as long as the device isn't passcode-locked
> The only defense is a very simple rule: don't plug your phone into a charger you don't own
These statements seem contradictory to me, unless I'm missing something. Shouldn't it be, "don't unlock your phone while it's plugged into a charger you don't own"? Or are they saying there are still vulnerabilities without the charger getting access to the UDID?
- deleted 13y ago[deleted]
- vinhboy 13y agoThis part also makes this a bit confusing: "As a final (and alarming) demonstration, they showed a Mactans-pwned phone turn itself on, swipe open, enter the passcode, and call another phone." So can they attack a passcode protected phone or not? Also, shouldn't this be one of those bugs they let apple fix first BEFORE they talk about it?
- deveac 13y agoI understood it that the initial attack vector required the target device to be unlocked. Once the malicious code was installed, the attacker could then gain complete control, including passcode unlock.
- xsmasher 13y agoIt sounds like "use a passcode on your phone and NEVER unlock (enter the passcode) while the phone is plugged into this charger" is also a defense. Unlock to check your email while plugged in? Compromised.