One caveat: If you unlock your phone while charging, there would be enough of a window to grab these files, I think (I haven't tested this, though)
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Facebook and Dropbox Apps for iOS Vulnerable to Credential Theft
- Thread starter MacRumors
- Start date
- Sort by reaction score
One caveat: If you unlock your phone while charging, there would be enough of a window to grab these files, I think (I haven't tested this, though)
- It does not require your device to be jailbroken. iExplorer (and similar programs) allows for viewing/modification of many files under the iOS "mobile" account (not root).
- I believe having a passcode lock will protect against this. iOS keeps things encrypted. That's why with methods to bypass the lock screen (like the iPad 2 smartcover trick) resulted in the inability to launch programs or load emails.
- The DFU exploit to get the unlock code for your device (demonstrated on a YouTube video) only works on pre-A5 devices (it uses the limera1n exploit). iPhone 4S, iPad 2, and iPad (3rd generation) are immune.
Basically, get yourself a nice A5+ device and keep a passcode on it.
- The DFU exploit to get the unlock code for your device (demonstrated on a YouTube video) only works on pre-A5 devices (it uses the limera1n exploit). iPhone 4S, iPad 2, and iPad (3rd generation) are immune.
Basically, get yourself a nice A5+ device and keep a passcode on it.
This isn't true. There are other workarounds for A5 and later devices. Passcode all you want, it won't protect you although it will help for the general user.
It's unfortunate. You don't really expect a company as big as Facebook to have such blatant security issues, but the reality is that big companies are usually rife with these types of issues because developing these big sites with hundreds of developers working on dozens of projects simultaneously is hard to manage well. Facebook is a $100+ billion dollar company and is dominant in their field, but the reality is that they are putting their brand at risk with the way that most Facebook Apps on the platform work - many of these Apps request many more permissions to do crazy stuff (post on my profile automatically, access my data anytime, etc) and that just makes me extremely hesitant to use any Apps. This is the biggest privacy issue on Facebook IMO. People talk about Facebook sharing data with companies through ads, but regardless of whether people use the types of companies listed at http://www.buyfacebookfansreviews.com or Facebook ads directly, no company advertising on Facebook is getting access to any personally identifiable information through ads - the Apps issue is much bigger. Everybody would be smart to avoid installing ANY Facebook Apps they are not 100% sure about.
Try it. Download iExplorer and look at your connected devices. It doesn't challenge you for your passcode.
Funny to see people afraid for their privacy yet they use Facebook in the first place.
Sharing your personal info with friends, associates, marketers, companies/products, celebrities, and people you hardly know = OK
Sharing that same info with someone else = Oh noes!
Sharing your personal info with friends, associates, marketers, companies/products, celebrities, and people you hardly know = OK
Sharing that same info with someone else = Oh noes!
[/COLOR]
How about using the power adaptor for the iOS device plugged directly into the wall plug?
How about using the power adaptor for the iOS device plugged directly into the wall plug?
I don't get how these big corporations create such crappy apps.
Facebook doesn't put any effort into their mobile app because it doesn't make them money. They don't serve any ads on it so they don't make cash with it. If they can get you to use the normal website version they will.
That doesn't mean that the danger isn't present.
If you had your phone connected to some public power source and you received a phone call, you might be tempted to unlock your phone and keep the charger cable connected. A better solution would be to put a data-condom on your USB connection to prevent any data from ever being transmitted on the cable. That solution would give data protection to any USB device you wish to charge via a public terminal.
The small external USB batteries (like the Duracell model) implicitly provide this kind of protection.
You can get Dock connector cables that charge only and do not sync. Many of the cheap ones do this.
Seriously? These companies are storing secret keys in plain text on a shared device? Crypto 101 says that is seriously a not cool thing to do.
My guess is the location of authentication data may now find its way onto Apple's approval process checklist.
Though a bit dated from 2009, see Question 6 of Apple's response letter to the FCC's inquiry regarding Apple's approval process:
http://www.apple.com/hotnews/apple-answers-fcc-questions/
I realy can´t understand how difficult it can be for Facebook to hire some decent programmers.
A crapy iOS app. And when i use their webpage, every now and then it just says: Your personal page is not accessable. Please try again in a few hours. Not to speak about their message system.
Totally unprofessional.
A crapy iOS app. And when i use their webpage, every now and then it just says: Your personal page is not accessable. Please try again in a few hours. Not to speak about their message system.
Totally unprofessional.
This does not affect devices that were not jailbroken. It only affects jailbroken devices.
When you jailbreak, you are "breaking" the BSD jails" iOS uses to separate third party app processes from accessing each others data stores and accessing hidden data not accessible by the official api.
A file manager app on a jailbroken device can see all of the directories on the device where a standard iOS install is locked down.
To avoid these vulnerabilities, simply don't jailbreak your device.
When you jailbreak, you are "breaking" the BSD jails" iOS uses to separate third party app processes from accessing each others data stores and accessing hidden data not accessible by the official api.
A file manager app on a jailbroken device can see all of the directories on the device where a standard iOS install is locked down.
To avoid these vulnerabilities, simply don't jailbreak your device.
If your phone is lost, can't the person who finds it jailbreak it and then do this exploit? You can't remote wipe it if they keep it off the Internet (like by putting it in airplane mode).
You are totally missing the point. Plugging in a non jailbroken device into a rogue charger can also expose your credentials. Try it yourself using iExplorer.
Apple maintain the mac builds of java. Those issues were fixed on other platforms some time ago, so the java issue was significantly an apple one.
