Why iPhone jailbreaks are good for security

Jailbreaking iPhones and iPads has always relied on security vulnerabilities. Different jailbreaking strategies have relied on issues in the browser related to image rendering or open font standards or - as again in this case - PDF rendering. The big difference this time is that you don't need to tether your phone to jailbreak it.

A drive-by attack like the ones this particular issue could enable is a big security vulnerability that could be used to load all kinds of malicious code onto a system. Instead it's been thrown away on something relatively benign - and the jailbreaking site even has a tool to block the vulnerability after it's used it. That's what happens with jailbreaking.

One of the jailbreak tools used up three zero-day vulnerabilities, at least one of which was present in multiple other devices. That's as many zero-days as were used in Stuxnet (the common belief is that Stuxnet was designed by a government agency to attack an Iranian power station - true or not, that's the kind of attack you save this many zero day vulnerabilities for).

Thanks to the jailbreakers, instead of being used to steal credit card numbers or the salts for RSA's SecureID keys or Google's source code or whatever else the professional criminal hackers in China and Russia and elsewhere are after this week, they were publicly disclosed with no more damage done than a few more jailbroken phones - and they were fixed in far more systems than the iPhone and iPad.

You could almost say jailbreakers are performing a public service, penetration testing technologies and doing very little evil with their discoveries. Unlike Sophos, I don't think it's going to be Apple that's furious about this; I think it's going to be hackers who were hoarding those for more serious attacks.

It's worth noting that browser and OS security vulnerabilities are dwarfed by application vulnerabilities and those are what most hackers target - including server-side applications like the ones LulzSec took advantage of. Even so, I find myself ambivalent about the Facebook embedded Skype video chat, because it replaces the potential attack surface of a plugin with the potential attack surface of Java, which I no longer install on any PC I use. The update system for Java is frequently broken; the updater is impolite, it's not always digitally signed - a horrendous failing in a security tool - but an unpatched Java installation is vulnerable to several attacks. Every technology has security issues; what matters is how much effort the developers are putting into addressing them - and how open they are about admitting them and warning people. And that could be Apple's biggest security flaw of all.

Mary Branscombe