Apple kills code-signing bug that threatened iPhone users
Hacker who discovered it remains excommunicated
Apple has patched a serious bug in iPhones and iPads that allowed attackers to embed secret payloads in iTunes App Store offerings that were never approved during the official submission process.
Charlie Miller, who is principal research consultant at security firm Accuvant, was kicked out of the iOS developer program on Tuesday after demonstrating the danger posed by the weakness. The InstaStock title that he wrote and was accepted into the app store in September billed itself as nothing more than a program to track the share prices of publicly traded companies. But behind the scenes, it bypassed protections built into iOS devices that prevent code from running on them, unless it's signed by Apple's official cryptographic seal.
As a result, InstaStock allowed Miller, who is the other coauthor of The Mac Hacker's Handbook, to surreptitiously spy on anyone who installed the app. Just hours after he disclosed the secret functionality – and the bug that made it possible – Apple excommunicated him from the developer program, making him ineligible to test the security of new products before they are released to the public.
On Thursday, about 48 hours after Miller exposed the threat, Apple said it had closed the security hole in iOS 5.0.1.
“A logic error existed in the mmap system call's checking of valid flag combinations,” the advisory said. “This issue may lead to a bypass of codesigning checks.” The threat had existed since the release of iOS 4.3.
Code signing represents a significant barrier to getting malicious apps on iPhones and iPads that haven't been jailbroken. It prevents code from running on the devices unless it has been digitally signed by Apple officials, and it also stops developers from modifying the app after the fact. It is perhaps the single biggest security distinction between iOS and Google's rival Android operating system.
Miller was able to circumvent code signing after he discovered an exception that was introduced in iOS 4.3 that, for the first time, created a small region in iPhones and iPads where unsigned code downloaded from the internet could be executed. The exception was designed to improve the performance of Safari by allowing it to do just-in-time compiling.
Thursday's iOS update also includes fixes for at least four other security threats, including a flaw that allowed locked iPad 2 devices to be opened without entering a passcode. ®
Tagline: "Hacker who discovered it remains excommunicated"
And rightly so. You cannot sign up to the iOS Developer Program, find a bug and then release an app to exploit that bug. This guy sounds more like a fame-hunter than a security professional. He should've informed Apple about the bug and let them fix it. He probably had betas 1 and 2 of iOS 5.0.1 and could've raised it with them if it were still present in those betas. As far as I know, he didn't.
Uploaded to the store in September. Disclosed in November. What was he waiting for? Was it just that nobody downloaded it in October and so he didn't have the clinching proof of concept?
"He should've informed Apple about the bug and let them fix it."
Unfortunately, Apple's iRDF (iProduct Reality Distortion Field) would have counteracted any attempt to engage an iOS engineer in a useful fashion.
There have been multiple instances over the recent years where app developers and users have reported verifiable, repeatable problems to Apple engineers, either directly or via forums, only to be told by Apple that either (1.) they're "doing it wrong," or (2.) they're not welcome any more.
Not that Apple is the only organisation guilty of this; it happens at Microsoft and in the FLOSS (Free/Libre` Open Source Software) worlds as well. It's probably not very uncommon for programmers at the top of any operating system or API development pyramid to exhibit a certain amount of hubris and/or "ostrich-puts-head-in-the-sand" behaviour...