Feeds

Apple kills code-signing bug that threatened iPhone users

Hacker who discovered it remains excommunicated

Using blade systems to cut costs and sharpen efficiencies

Apple has patched a serious bug in iPhones and iPads that allowed attackers to embed secret payloads in iTunes App Store offerings that were never approved during the official submission process.

Charlie Miller, who is principal research consultant at security firm Accuvant, was kicked out of the iOS developer program on Tuesday after demonstrating the danger posed by the weakness. The InstaStock title that he wrote and was accepted into the app store in September billed itself as nothing more than a program to track the share prices of publicly traded companies. But behind the scenes, it bypassed protections built into iOS devices that prevent code from running on them, unless it's signed by Apple's official cryptographic seal.

As a result, InstaStock allowed Miller, who is the other coauthor of The Mac Hacker's Handbook, to surreptitiously spy on anyone who installed the app. Just hours after he disclosed the secret functionality – and the bug that made it possible – Apple excommunicated him from the developer program, making him ineligible to test the security of new products before they are released to the public.

On Thursday, about 48 hours after Miller exposed the threat, Apple said it had closed the security hole in iOS 5.0.1.

“A logic error existed in the mmap system call's checking of valid flag combinations,” the advisory said. “This issue may lead to a bypass of codesigning checks.” The threat had existed since the release of iOS 4.3.

Code signing represents a significant barrier to getting malicious apps on iPhones and iPads that haven't been jailbroken. It prevents code from running on the devices unless it has been digitally signed by Apple officials, and it also stops developers from modifying the app after the fact. It is perhaps the single biggest security distinction between iOS and Google's rival Android operating system.

Miller was able to circumvent code signing after he discovered an exception that was introduced in iOS 4.3 that, for the first time, created a small region in iPhones and iPads where unsigned code downloaded from the internet could be executed. The exception was designed to improve the performance of Safari by allowing it to do just-in-time compiling.

Thursday's iOS update also includes fixes for at least four other security threats, including a flaw that allowed locked iPad 2 devices to be opened without entering a passcode. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Attackers raid SWISS BANKS with DNS and malware bombs
'Retefe' trojan uses clever spin on old attacks to grant total control of bank accounts
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
prev story

Whitepapers

Seven Steps to Software Security
Seven practical steps you can begin to take today to secure your applications and prevent the damages a successful cyber-attack can cause.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.