











Comments     Threshold


RE: Apple and security? Where?
By gstrickler on 9/2/2009 12:07:39 PM , Rating: 0
The iPhone could be completely taken over with an SMS message.
Let me count the ways that's incorrect.

1. He didn't "take over" an iPhone with the attack. He triggered a buffer overflow (actually an underflow in this case), but said he had no idea if he could, or how to turn it into an exploit that would allow control or execution of specific code. Right now, it's a potential DoS attack.

2. The "SMS message" was a malformed (i.e. improper) message. He didn't do it by sending an SMS message through the cellular network, he had to jail-break the iPhone, install a custom framework that allowed him to inject "SMS messages" he sent to the phone via Wi-Fi, then send the a malformed "SMS message" to the phone via Wi-Fi.

3. There is no evidence that you can send such a malformed message through any cellular network. The attacker would either have to hack the cellular network first, or set up their own hacked cellular transmission station that impersonated the carrier's network.

So, what he demonstrated was a proof of concept attack that shows there is at least one buffer underflow in that version of the iPhone software, but he did not demonstrate or claim that he could exploit that underflow.

RE: Apple and security? Where?
By HrilL on 9/2/2009 1:15:25 PM , Rating: 3
Well you're miss informed. This was able to be exploited and it could allow them to take over the phone completely. You read the proof on concept when it first came out but after that people were able to exploit this. This was shown at black hat. Before you go off defending apple maybe you should know the facts. The black hat event is what lead apple to finally release OS 3.0.1 to fix this vulnerability.

RE: Apple and security? Where?
By gstrickler on 9/2/2009 4:54:04 PM , Rating: 1
You're misinformed, the only part of my post that needs updating is that Miller did figure out a way to exploit it.

The Miller/Mulliner attack was performed via Wi-Fi on a jailbroken iPhone with their fuzzing framework installed, not via OTA SMS messages. Android and Windows Mobile phones were susceptible to the same attack. Android firmware was updated before the Black Hat demonstration, and the iPhone firmware was updated within 24 hours, so the only vulnerable phones are those who haven't updated their firmware and those running Windows Mobile. As far as I can determine, no one has yet demonstrated that this attack and be performed via OTA SMS messages through a carrier network, although the Miras/Lackey attack make me suspect that it might be possible using some carrier(s).

The Miras/Lackey attack is a carrier and GSM problem, it's not specific to the iPhone, and it may be limited to specific (unidentified) carrier(s). As demonstrated, it does not allow taking control of the phone, just changing it's settings such as the Proxy, so it can be used to redirect internet traffic and perform man-in-the-middle attacks.

