Feeds

Apple kills code-signing bug that threatened iPhone users

Hacker who discovered it remains excommunicated

Build a business case: developing custom apps

Apple has patched a serious bug in iPhones and iPads that allowed attackers to embed secret payloads in iTunes App Store offerings that were never approved during the official submission process.

Charlie Miller, who is principal research consultant at security firm Accuvant, was kicked out of the iOS developer program on Tuesday after demonstrating the danger posed by the weakness. The InstaStock title that he wrote and was accepted into the app store in September billed itself as nothing more than a program to track the share prices of publicly traded companies. But behind the scenes, it bypassed protections built into iOS devices that prevent code from running on them, unless it's signed by Apple's official cryptographic seal.

As a result, InstaStock allowed Miller, who is the other coauthor of The Mac Hacker's Handbook, to surreptitiously spy on anyone who installed the app. Just hours after he disclosed the secret functionality – and the bug that made it possible – Apple excommunicated him from the developer program, making him ineligible to test the security of new products before they are released to the public.

On Thursday, about 48 hours after Miller exposed the threat, Apple said it had closed the security hole in iOS 5.0.1.

“A logic error existed in the mmap system call's checking of valid flag combinations,” the advisory said. “This issue may lead to a bypass of codesigning checks.” The threat had existed since the release of iOS 4.3.

Code signing represents a significant barrier to getting malicious apps on iPhones and iPads that haven't been jailbroken. It prevents code from running on the devices unless it has been digitally signed by Apple officials, and it also stops developers from modifying the app after the fact. It is perhaps the single biggest security distinction between iOS and Google's rival Android operating system.

Miller was able to circumvent code signing after he discovered an exception that was introduced in iOS 4.3 that, for the first time, created a small region in iPhones and iPads where unsigned code downloaded from the internet could be executed. The exception was designed to improve the performance of Safari by allowing it to do just-in-time compiling.

Thursday's iOS update also includes fixes for at least four other security threats, including a flaw that allowed locked iPad 2 devices to be opened without entering a passcode. ®

Endpoint data privacy in the cloud is easier than you think

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Microsoft's Euro cloud darkens: US FEDS can dig into foreign servers
They're not emails, they're business records, says court
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
iWallet: No BONKING PLEASE, we're Apple
BLE-ding iPhones, not NFC bonkers, will drive trend - marketeers
Multipath TCP speeds up the internet so much that security breaks
Black Hat research says proposed protocol will bork network probes, flummox firewalls
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
Plug and PREY: Hackers reprogram USB drives to silently infect PCs
BadUSB instructs gadget chips to inject key-presses, redirect net traffic and more
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
prev story

Whitepapers

7 Elements of Radically Simple OS Migration
Avoid the typical headaches of OS migration during your next project by learning about 7 elements of radically simple OS migration.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Solving today's distributed Big Data backup challenges
Enable IT efficiency and allow a firm to access and reuse corporate information for competitive advantage, ultimately changing business outcomes.
A new approach to endpoint data protection
What is the best way to ensure comprehensive visibility, management, and control of information on both company-owned and employee-owned devices?