Feeds

iPhone hackers disclose vulns and hunt for clues

Closing in on their Holy Grail

Secure remote control for conventional and virtual desktops

The game is on for hackers trying to spot security vulnerabilities in Apple's iPhone and already they're scoring points. Less than 72 hours after the iPhone's introduction, researchers have reported at least one flaw that could allow an attacker some level of control over the device, while other hackers have uncovered passwords hiding in Apple software that could prove key in gaining root access, they said.

The most serious flaw, reported by Errata Security, resides in the iPhone's Safari browser. By effecting a buffer overflow in the application, an attacker can take control of the browser and run code on the device, said Robert Graham, CEO of Errata.

"The scenario that seems most attractive is to have the phone dial 900 numbers," Graham said, noting an age-old attack that allows criminals with ties to fee-based phone services to profit each time an infected computer dial the number.

It's one of the same Safari flaws Errata researchers documented earlier this month, just hours after Apple released a beta version of the app for Windows users. Apple moved quickly to fix several, but not all, of the bugs.

Errata also reported a bug that resides in the iPhone's Bluetooth features. By exposing them to a fuzzer, it seems, it's easy to make the entire device lock up in a very predictable manner.

Apple representatives didn't respond to a request for comment.

Since Friday's release of the iPhone, hackers have raced to spot bugs in the device or get it to behave in ways its designers didn't intend. Researchers have yet to unlock the phone so it can be used on networks other than AT&T's or get it to run Linux, but they say they're making progress.

They've also assembled a Wiki designed to foster the sharing of information relating to topics such as breaking the activation, unlocking the phone so it can run on multiple networks and allowing the running of third party applications.

Among the advances made to date, hackers have discovered the password the iPhone requires to give an application root access is, amazingly, "dottie" (minus the quotation marks). A second password for mobile access is "alpine."

The passwords were remarkably easy to learn. Researchers posting in a forum on Hackintosh first downloaded the file that iTunes accesses when a user wants to restore the iPhone software. A simple run with John the Ripper, a popular password cracking program, on one of the files contained in the download and the passwords became public knowledge.

"As of yet, those passwords do not have a specific use, but that's not to say that within the next 20 minutes somebody finds a service on port 123 and we can log into it," said Kevin Finisterre, an independent security researcher who has been trying to learn as much as he can about the iPhone.

While no one has yet been able to obtain root access to the iPhone - which amounts to the Holy Grail to those hacking the device - Finisterre says he has reason to believe that's only a matter of time. That's because he has been examining information in files that are created each time the device crashes. Each one has listed the effective user for an application as root.

Hackers are publicly aspiring to plenty of other tricks, including breaking digital rights management functionality in the iPhone. Just because it hasn't happened yet, doesn't mean it never will.

"I don't think enough researchers like myself have the iPhone in their hands," said Finisterre, who isn't willing to shell out the $500 to obtain a device. "Once folks like us get a hold of the thing, I think you're going to see quite a bit of stuff go on." ®

The essential guide to IT transformation

More from The Register

next story
Apple's iWatch? They cannae do it ... they don't have the POWER
Analyst predicts fanbois will have to wait until next year
Barnes & Noble: Swallow a Samsung Nook tablet, please ... pretty please
Novelslab finally on sale with ($199 - $20) price tag
Apple to build WORLD'S BIGGEST iStore in Dubai
It's not the size of your shiny-shiny...
Just in case? Unverified 'supersize me' iPhone 6 pics in sneak leak peek
Is bigger necessarily better for the fruity firm's flagship phone?
Steve Jobs had BETTER BALLS than Atari, says Apple mouse designer
Xerox? Pff, not even in the same league as His Jobsiness
Apple analyst: fruity firm set to shift 75 million iPhones
We'll have some of whatever he's having please
TV transport tech, part 1: From server to sofa at the touch of a button
You won't believe how much goes into today's telly tech
The agony and ecstasy of SteamOS: WHERE ARE MY GAMES?
And yes it does need a fat HDD (or SSD, it's cool with either)
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
BYOD's dark side: Data protection
An endpoint data protection solution that adds value to the user and the organization so it can protect itself from data loss as well as leverage corporate data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?