Apple Investigating iOS Vulnerability Allowing Web-Based Jailbreak

[ccdan]

Write to the flash memory continuously for example. Do calculations in the background sucking energy from the battery and making it's life span shorter.

the same could be said about many other things, like hdd drives, flash drives and so on... and suprise, the manufacturers have to offer warranty for those products... besides, there are all the other smartphones that can have such apps installed (that "suck" battery life) and still have to offer warranty

 

[hwhalers]

but electronics hardware manufacturers are expected to offer warranty for their stuff regardless of the software used on their products!

Apple should replace stuff that has been cracked, and has hardware defects. That's completely reasonable, and I'd agree without reservation whatsoever. I got confused by what you meant by support and warranty. Apologies for that.

 

[Bakafish]

LOL! how could unsigned software "damage" such a device?
regardless of whether it's signed or unsigned, the code is just code that's going to be "executed" by the integrated circuits... also any other elctronic components have their physical limits of operation so that they can't really get "damaged" by the instructions they get from the main cpu (if they get damaged, they're defective)

the signed/unsigned aspect is a software one, whose purpose is to prevent you from running whatever you whish on YOUR device, which is your property (and no, the code is not the property of the device maker, as some IP fanatics tend to claim)
with such restrictions in effect you'll be forced to get all the stuff you want from the manufacturer of the device or its partners... the manufacturer will get paid by anything you use, in one way or another...

It is far easier to bypass the software protections that the OS has in place if you bypass Apple's app submission process. No way are you going to have access to the baseband or block level devices. The thermal protection is also implemented in IOS, and there are other things that could potentially brick the hardware. So while I think it is just the cost of doing business, Apple can legitimately think different. If you want to give me root on your iPhone and don't think I can brick it, you are a fool. How many app store apps can brick a phone?

As for the person who said that Apple can easily find the exploit that was used, of course they can, so can any black hats now too. My point was clearly that if there was an authorized path they would have disclosed the exploit to Apple prior to it being "in the wild." And if you think they don't have several more undisclosed exploits waiting in the wings you're a fool. I'd rather that they were disclosed to Apple instead of becoming zero day hacks. But as it is they are forced to hide them. The baseband exploits are even scarier...

 

[goosnarrggh]

reverse engineering is used for a variety of things, not only for bypassing IP security measures... and many aspects of the DMCA and related laws are not extremely clear in all circumstances... for example, apple claimed that jailbreaking is violating the DMCA for a variety of resons among which the fact that it allows to run pirated content... another example is that of DeCSS product - the author was detained, interrogated and what not, but finally all charges were dropped... also, in many European countries reverse engineering is explicitly allowed by national legislation (if I'm not mistaken there's also some EU directive that specifically permits such things)

Indeed, even in the absence of any of the LoC exemptions, the DMCA also includes a section stating that reverse engineering and breaking digital locks, as well as the creation and distribution of tools to perform such activity, is explicitly permitted in certain circumstances, including to allow research into the creation of inter-operable software products.

 

[goosnarrggh]

You mean _most_ people. Most people can't be bothered with such stuff. My opinion is that it is best to pressure Apple to make the best, most functional device possible...

And in terms of making the best security features possible, the most effective form of pressure has proven to be the threat that, if Apple fails to fix their holes, a hacker will come along and exploit it.

Which is exactly what has happened in this circumstance.

 

[ranReloaded]

Good move Apple. Yes they want to stop jailbreaking, but I trust the iPhone Dev Team to find another way in (they already admitted to having one). This is a good hole to fix so I can continue to errantly download PDFs from people I don't know.

From what I've heard, the "fix" available doesn't fix the vulnerability, it just warns you before opening a PDF. It will help in those cases in which a site is crafted so as to trick you into inadvertly dl a pdf, it DOESN'T tell the malicious pdfs appart.

 

[Torrijos]

The point being that instead of being good (or nice) hackers and report the bug to Apple for the good of all users that purchased a iOS devices, they exploited it which can be compared to releasing publicly a "how to" (a lot of tread tried and discovered how it worked) allowing bad hacker to themselves exploit said bug before Apple can work it out.

It was at best irresponsible, but I feel that moronically arrogant fits better.

 

[Max(IT)]

not going to help

the small team mentality is what causes this. MS had the same problem in the late 1990's and used to work like Apple. the talented engineers are like kids and like to do cool new things but don't like to audit code and get all the bugs out.

apple needs to hire junior devs to go over code and stop the idiotic secrecy so people can work together

And you clearly know better than Apple management how to run a multinational company, right ?
Omg, how many SteveJobs and Bill Gates on this forum ...

 

[ccdan]

It is far easier to bypass the software protections that the OS has in place if you bypass Apple's app submission process.

yeah, and that's a good thing... however, there shouldn't be any protections that the owner of the device wouldn't be able to disable/override

No way are you going to have access to the baseband or block level devices. ...

I'm not sure what those things are

The thermal protection is also implemented in IOS, and there are other things that could potentially brick the hardware.

The thermal protection is a hardware thing that protects the components, the iOS just warns about overheating so that you know why it stopped... it's smilar to a cooler in a pc and the warning of the ios is the equivlent of th warning a pc might give if you, if you stress the system too much - but all this thing is done so that THE SOFTWARE CANNOT DAMAGE THE HARDWARE... if any electronic component in a pc/phone/whaever can be damaged by the software, it means that it's defective/badly designed/whatever - in short it's not a good component

If you want to give me root on your iPhone and don't think I can brick it, you are a fool. How many app store apps can brick a phone?

LOL!
it depends on what you mean by brick... if you can physically damage some internal component using some "nasty" code, then that component is unsuitable for the device... on the other hand, if you want to say that you can somehow lock/block the device with some "nasty" code, well that's true, but it is also reversible... the same thing can happen to ordinary PCs for example when you try to install osx86 and get some weird bootloader that won't boot any os - but that's fixable! of course, it would not be the duty of pc manufacturer to fix your failed attempts to install exotic OSes... conversely if you "lock" your iphone trying weird things, it wouldn't be the duty of apple to fix your mistakes - as long as the "lock" is a direct consequence of bad instructions by you, and not some shady "security" system that tries to lock you out "on purpose" because you modified the software... only the hardware components should be replaced or fixed in case they mafunction

 

[bobr1952]

Are you all jailbroken?

Hardly--this forum has almost half a million members. I certainly have no intention of jailbreaking my one and only phone. I have no need or desire--it is fine just the way it is.

 

[h4ck]

it wasn't adobe's PDF rendering engine.

Sure about that?

 

[Drag'nGT]

I hope they plug the hole. They should have their own team looking at how a JB is accomplished and they fix them ahead of time. At least that's my wish.

 

[YadaMikeyada]

Don't tell me that with file system access and root I'd be able to waste a weekend compiling and installing alternative services and libraries and applications. I don't care if I can do it, I don't want to. I don't have the time to do it even if I did. If that's your cup of tea, go nuts. But you can't expect to be the focus of a multi-billion dollar corporation.

I buy a device to solve problems, not create new ones.

Nothing that complicated. Cydia does all the work - you just choose the apps you want to install. Some, like the App Store, require a purchase. You can add additional repo addresses as well.

Mywi is worth every penny of the $19.95 purchase price. I can use my iPad anywhere there is AT&T 3G service using my iPhone as a hot spot.

 

[JAT]

no matter how you look at this analogy, it's unbelievable stupid!
first of all, guns don't have mechanisms or "licens agreements" that prevent you from modifying them or using them anywhere... if you use a gun to kill people, it's just like using an iphone to kill people from a legal standpoint (even if it's far more difficult to do that with the latter)

I understand your points (I was jb'ed for many months), but your reasoning is quite faulty. And you are labeling the reasoning of others as faulty when they are not.

Just as one example is this quote. Actually, there are many laws or rules in place that prevent the modification of legal guns, which modifications would make them illegal. Or the use or even presence of them in certain places.

Your original point is that you should be allowed to do anything you want with any product you may buy. But that is so entirely flawed I can barely keep a straight face here at work. Why don't you drop the Viper and compare to an AMG which can do over 200mph, but is limited at 155 in many countries? And it isn't ridiculously hard to overcome that limit, but it is against various rules.

The fact is, you have an opinion about what cell phone functions should be "legal", what functions should be "allowed", and what should not. And yours is different from other people, including from the manufacturer of the iPhone. You are going to have to come to grips with that.

Since jb'ing is possible, I don't really see why there is such uproar all the time. You have to do the same to Android to get full access, but somehow on those phones it's seen as a positive by the whiny types, and it's a negative on the iPhone. Maybe y'all just hate Apple and can't get over it.

 

[swagi]

*yawn*

To go BOT and stop this stupid Jailbreak Pro/Con-discussion, I just wanted you to know, that Apple has their next bad media spin.

Feel free to read if you know German.Link to German news n-tv

So basically your device can now be rooted by using mobile Safari. Honestly I could care less about jailbreaking - but this a complete no-go if you use an iOS 4 device in a business environment.

 

[Master Chief]

Company spokeswoman Natalie Harrison said the company was aware of the report.

"We're investigating," she said.

Not a surprise. I would have been more surprised when Apple said not to look into it. Even if it was a PR spin only.

 

[3.1416]

What a stupid idea of "freedom" you have.

Yeah, property rights are so 18th century. Doing exactly what large corporations tell you to is the cool thing now.

By finding and exploiting a flaw, the jailbreakers give Apple no choice but to close the security hole.

Apple needs to fix this bug immediately, and that would be true whether or not the jailbreak was released.

Do you think the "freedom" you want will ever take responsibility for the hacker who gets a rootkit on the iPhone to steal your banking information?

How have you survived using Macs all this time?

 

[DMann]

So now it's legal. Big yip. It still means finding and exploiting security holes to override the prohibition on unsigned software. Which gives you things you may like, but they are a pain for the rest of us. Thanks, genius.

What, then, might you be suggesting?

 

[taylordubi]

Jailbreaking

Why are so many of you against jailbreaking? I have been doing it since the first gen iPhone and I have only had positive experiences with it. There are so many more possibilities and options with a jailbroken iOS.....

I bet Steve even jailbreaks...

 

[MacKeeperFanMod]

Apple needs to stop slacking

These file format vulnerabilities are beginning to annoy me. PDF has been around for how long now? How fscking hard can it be to write a robust parser for a PDF with the amount of resources available with companies like Apple? It is nothing more than gross negligence.

 

[Xibalba]

at least Apple is not denying there is a problem. unless, they are going to use this opportunity to somehow direct complaints towards Adobe and continue to fuel the fire between the companies.

hole will be plugged up soon enough and make this a moot point. kudos to the hackers for a web-based hack for jailbreaking...

 

[YadaMikeyada]

Killer apps

I wanted to add that of 4 killer jailbreak apps, Mywi, Safari Download Mgr., iFile and MXTube (among others), 2 of these are now in the App Store:

Download HD: better in some respects to the Safari plug-in and Safari Download Mgr., this app allows you to download and view in most cases, any document and any audio or video file using a WebKit based browser.

MITube: Formally known as the Cydia app, MXTube. YouTube video downloader.

For my money, and for the variety of document viewers available in the App Store, the premiere File Manager and document viewer is still the Cydia app, iFile. Search, copy, move and delete content. Allows me to make my own choices where to store content on my phone or iPad. It's document handling, incuding audio and video is bar-none.

 

[ccdan]

but your reasoning is quite faulty.

No, it's not faulty at all!

Just as one example is this quote. Actually, there are many laws or rules in place that prevent the modification of legal guns, which modifications would make them illegal. Or the use or even presence of them in certain places.

Guns are not a very good example in this context because they're only used for two things: to inflict wounds or kill! Besides they're completely banned in many countries! The rules in place aim to reduce real world crime and has nothing to do with our discussion!

But that is so entirely flawed I can barely keep a straight face here at work. Why don't you drop the Viper and compare to an AMG which can do over 200mph, but is limited at 155 in many countries? And it isn't ridiculously hard to overcome that limit, but it is against various rules.

LOL! Your thinking is actually extremely flawed! You'll have to really carefully analyse and reconsider your ideeas and you'll se how absurd they are!

There are absolutely no rules against getting rid of that limit! Have you ever heard of Brabus or Carlsson?
That limit is due to a "gentleman's agreement" between the major german car manufacturers... but you can modify your car as you wish as long as it passes a standard technical test, so that it's deemed safe for use! Besides, there are cars from those manufacturers without any speed limit!

But let's leave aside the examples that involve things that might cause serious accidents or might kill... How about being prevented from modifying your computers, hi-fi equipment, kitchen appliances, furniture or even clothes? The best analogy would be computers, because no matter how you modify the software already installed or no matter of what other software you instal, the manufacturers will have to offer warranty... an in many cases, even if the hardware parts get changed, the manufacturers still have to replace damaged products if they can't prove that your modifications caused the damage...

The fact is, you have an opinion about what cell phone functions should be "legal", what functions should be "allowed", and what should not. And yours is different from other people, including from the manufacturer of the iPhone. You are going to have to come to grips with that.

I actually want one thing: to own and control whatever products (not services) I buy! And not to be controlled by others!

Since jb'ing is possible, I don't really see why there is such uproar all the time. You have to do the same to Android to get full access, but somehow on those phones it's seen as a positive by the whiny types, and it's a negative on the iPhone. Maybe y'all just hate Apple and can't get over it.

On android phones you can install whatever app you whish from whatever source you whish! You can find tons of really useful apps that don't have even one single equivalent in the app store, because apple doesn't offer access to the API's and would not approve such apps, like conversation recorders (storing the data on the phone), remote tracking/locators , etc..