Slash Lane
Sean Sullivan, security advisor with F-Secure Corporation, revealed on Tuesday the technical details of the jailbreak process, which is done entirely in the Mobile Safari browser. The jailbreakme.com site includes 20 separate PDFs for different combinations of hardware and firmware.
The same PDF files rely on a corrupt font, and crash the Safari browser's Compact Font Format handler.
Sullivan also linked to comments made via Twitter by security researcher Charlie Miller, who was also analyzing the code behind the browser-based jailbreak.
"Very beautiful work," Miller wrote. "Scary how it totally defeats Apple's security architecture."
While the jailbreakme.com URL itself is not intended for malicious purposes, the PDF exploit it uses could be utilized by hackers to more nefarious ends. Miller said that with this method, a hacker does not need physical access to an iPhone, iPod touch or iPad — they just simply need to have the user visit a vulnerable website.
Last year, Miller exposed a dangerous SMS exploit that could allow a hacker to remotely control an iPhone. He notified Apple of the flaw, and the company quickly released a patch to plug the exploit.
Apple is likely to quickly act once again and plug the vulnerability that affects all iOS devices — all models of the iPhone, iPod touch and iPad. When that happens, hackers who want to jailbreak iOS devices to run unauthorized code and operating system modifications blocked by Apple will have to find another method.
The member of the iPhone Dev Team who goes by the handle "comex" said this week that he has other potential exploits he will look to when Apple inevitably patches the PDF flaw.
"Maybe I'll rely on USB based stuff for the next jailbreak so that Apple won't patch it so fast," he said.
Ironically, jailbreakers have already developed a workaround solution that can help users avoid being hacked through the PDF exploit. Developer Will Strafach on Tuesday released an application available on the jailbroken Cydia store that will warn users when a Mobile Safari page is loading a PDF file. The solution does not patch the hole, but helps to prevent users from visiting sites with all PDF files to avoid the exploit.
Andrew Orr
Amber Neely
William Gallagher
Christine McKee
AppleInsider Staff
90 Comments
Charlie Miller is also the person Apple credits with reporting a very similar bug in Mac OS X, which was patched in June of this year.
From a Computerworld interview with Charlie Miller
"There's no shell on the iPhone, so [comex] had to do all that himself to get control," Miller continued. "He elevated to root, turned off all code signing, broke out of the sandbox...all in the payload of the exploit.
"And it works every time. Not just a few times out of a hundred. But every time."
Now, who was it that said "It's not at this point a serious issue"?
still think android is so so so much more vulnerable?
"comprimise" - now that's professional...
question guys, have not read anything re this question anywhere
do you think Apple is not closing some security holes by purpose to leave a door open for the devteam ?
i mean, i am quite sure that Apple has some very clever and smart people, they should be able to close down the iOS if they really want ?!
we can observe that some USB security flaws are open in iOS3 and still in 4..... MS is doing a better job in patching their windows than Apple...
thanks for your opinions.
Greetings !
still think android is so so so much more vulnerable?
This is a serious issue, no one is denying that, and there will be other vulnerabilities found in iOS throughout the years that will just as bad, but Android is designed from the ground up to be insecure for the average user. That won’t change until Android changes.