ie8 fix
madison

Hardware 2.0

Adrian Kingsley-Hughes
Home / News & Blogs / Hardware 2.0

Your iPhone, iPad and iPod touch devices are all wide open to hackers

By | August 3, 2010, 10:44am PDT

Summary: Yesterday’s release of a web-based jailbreak for the iPhone, iPad and iPod touch highlighted just how wide open to hackers the iOS platform is.

Yesterday’s release of a web-based jailbreak for the iPhone, iPad and iPod touch highlighted just how wide open to hackers the iOS platform is.

Gizmodo lays it out:

It just requires the user to visit a web address using Safari. The web site can automatically load a simple PDF document, which contains a font that hides a special program. When your iOS device tries to display the PDF file, that font causes something called stack overflow, a technical condition that allows the secret ninja code inside the font to gain complete control of your device.

The result is that, without any user intervention whatsoever, that program can do whatever it wants inside your iPhone, iPod touch or iPad. Anything you can imagine: Delete files, transmit files, install programs running on the background that can monitor your actions… anything can be done.

Poll

Are you worried about the security of your iPhone, iPad or iPod touch devices?

Literally anything. The JailbreakMe 2.0 jailbreak highlights just how powerful these kinds of vulnerabilities are. If a PDF can jailbreak your device, it can do pretty much anything it wants.

And the iOS platform is a really juicy target for hackers. There are some 100 million iOS devices out there, none of which have any security software installed. Hackers must be licking their lips in anticipation.

Gizmodo does offer a potential workaround for owners of jailbroken devices, but everyone else is on their own.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Hardware 2.0”

Topics

Apple iPhone, Apple iPod, Adobe PDF, Apple iPad, Apple iPod Touch, Hacker, Font, Hacking, Security, Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology.

Disclosure

Adrian Kingsley-Hughes

All opinions expressed on Hardware 2.0 are those of Adrian Kingsley-Hughes. Every effort is made to ensure that the information posted is accurate. If you have any comments, queries or corrections, please contact Adrian via the email link here. Any possible conflicts of interest will be posted below. [Updated: February 23, 2010] - Adrian Kingsley-Hughes has no business relationships, affiliations, investments, or other actual/potential conflicts of interest relating to the content posted so far on this blog.

Biography

Adrian Kingsley-Hughes

Adrian Kingsley-Hughes is an internationally published technology author who has devoted over a decade to helping users get the most from technology -- whether that be by learning to program, building a PC from a pile of parts, or helping them get the most from their new MP3 player or digital camera.

Adrian has authored/co-authored technical books on a variety of topics, ranging from programming to building and maintaining PCs. His most recent books include "Build the Ultimate Custom PC", "Beginning Programming" and "The PC Doctor's Fix It Yourself Guide". He has also written training manuals that have been used by a number of Fortune 500 companies.

Adrian also runs a popular blog under the name The PC Doctor, where he covers a range of computer-related topics -- from security to repairing and upgrading.

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?
Ask a Question Start a Discussion
31
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
sfberli 19th Aug 2010
@NonZealot Nope, the password is not required in this case because the vulnerability allows code to be executed directly from memory, without you ever noticing it. It seems that DEP is not working in this case. BTW, iOS is not OS X.
View in thread
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Droid101 3rd Aug 2010
Jobs says they are safe... so they must be safe, right!?
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Pete "athynz" Athens 3rd Aug 2010
@Droid101 Actually Jobs is very much against jailbreaking by any means... which is why Apple was trying to make it illegal and why it's such a big deal that is is legal.

And this whole PDF thing - it requires user interaction... now those who lack common sense will inevitably screw things up but by and large jailbreaking is pretty safe if one uses common sense.
0 Votes
+ -
On this, you are wrong
NonZealot 3rd Aug 2010
@athynz
And this whole PDF thing - it requires user interaction...

Read the blog again, the vulnerability requires zero user interaction once you have been lured to an "infected" page. BTW, you don't even need to be going to "bad" places to find "infected" pages. It isn't uncommon to find "good" pages that are displaying "infected" ads.

The result is that, without any user intervention whatsoever, that program can do whatever it wants inside your iPhone, iPod touch or iPad. Anything you can imagine: Delete files, transmit files, install programs running on the background that can monitor your actions? anything can be done. (emphasis mine)

The jailbreaking page was programmed to require user interaction because the devs aren't trying to pwn anyone's iPhone. That was purely out of the goodness of their hearts though. The vulnerability they are exploiting doesn't technically require any user interaction at all.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Droid101 3rd Aug 2010
@athynz NZ said it. This has nothing to do with Jailbreaking. This is a security flaw requiring no user interaction.
0 Votes
+ -
It's okay, iPhone runs OS X...
NonZealot 3rd Aug 2010
and OS X doesn't allow any "bad" code to run unless you type in your administrator password. This makes drive by exploits absolutely impossible. Or so we are told.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
sfberli 19th Aug 2010
@NonZealot Nope, the password is not required in this case because the vulnerability allows code to be executed directly from memory, without you ever noticing it. It seems that DEP is not working in this case. BTW, iOS is not OS X.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Loverock Davidson 3rd Aug 2010
People on here are trying to convince me of why I need one if not all these devices (which I do own 1 of the 3). The scary part is if the Apple fanboys are right about corporations and educational institutions trying to implement these in their organization.
0 Votes
+ -
Exactly!
SonofaSailor 4th Aug 2010
@Loverock Davidson

This website and the fanbois have certainly gone along way to shovel out hype about "how ready" the iDevices are for the enterprise.

I'm glad I got caught up in the hysteria and hooked up consumer devices that my end users brought to work...because they thought it was cool, and I was too scared to say no.

Next time one of my end users brings a consumer device to work and wants it hooked up, I won't even think twice about it. If someone says it can be used at the enterprise, then by God it should be used!
0 Votes
+ -
What's your point Adrian?
Dietrich T. Schmitz, ~ Your Linux Advocate Updated - 3rd Aug 2010
Windows: protected mode
Ubuntu: AppArmor

If the issue becomes serious enough there will be software technology for mobiles as well and in some cases there already is.

P.S. AppArmor is merging to the mainline kernel 2.6.36--long overdue.
0 Votes
+ -
"If the issue becomes serious enough..."
Lester Young 3rd Aug 2010
@Dietrich T. Schmitz, Your Linux Advocate

It's not serious enough already? If the security lessons of desktops aren't incorporated into a mobile OS at the outset, that's screwing the pooch.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
ssj6akshat 4th Aug 2010
@Lester Young Linux kernel has already 3 MACs.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Pete "athynz" Athens 3rd Aug 2010
@Dietrich T. Schmitz, Your Linux Advocate His point is simply to get page hits...
0 Votes
+ -
nope it called
deaf_e_kate Updated - 3rd Aug 2010
@athynz
Anyone who markets the sh*t out of their products and it doesn't live up to the spin deserves a knock down and to be exposed and humiliated
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
tonymcs@... 3rd Aug 2010
@Dietrich T. Schmitz, Your Linux Advocate

Wow AppArmor!!!!

Both Linux users must be happy.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
clindhartsen 3rd Aug 2010
To be honest, doesn't this underline that no platform is absolutely secure and the only thing saving Apple has been that hackers are still more interested in PCs, as well as their numbers have been low in use in the past [security through obscurity]
0 Votes
+ -
Nothing is sacred
klumper 3rd Aug 2010
Why do we even bother?
0 Votes
+ -
It's only expected
Cylon Centurion 3rd Aug 2010
Anyone who thinks people won't try to exploit friendly software is kidding themselves. Apple, Microsoft, and even Linux-based operating systems will all be targeted once popularity increases.
That's like finding gold and expecting it not to be mined.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Agnostic_OS 3rd Aug 2010
Oh dear, Adobe PDF ruins Apple products....
oh dear...
0 Votes
+ -
Are you SURE Apple is using Adobe's PDF reader in iOS?
NonZealot 3rd Aug 2010
@Agnostic_OS
I would be very surprised if there was a single stitch of Adobe's code running anywhere in iOS. You do realize that you don't have to use Adobe's code to display PDF files and considering that Apple uses their own code to display PDFs in OS X, it makes sense that they would use that exact same code (or something close to it) to display PDFs in iOS. PDF support isn't an add-on to OS X, it is embedded very deeply in the OS.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Agnostic_OS Updated - 3rd Aug 2010
@NonZealot I was alluding to yet again Adobe name is in the frame. Tentative I grant you BUT it was not about the reader but about PDF - a file format standard started and promoted by Adobe that does Apple no favors in this case.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
casiodorus 4th Aug 2010
Hackers, spammers and fraudsters are really, really, REALLY going to be enjoying themselves with this one.

I mean...they just need to inject some lovely code in to some vulnerable SQL or Ad servers at popular web sites, and then suddenly *POOF* they can instantly infect practically every Apple iPhone/iPad/Touch in the world.

100 million strong Apple hardware devices eh? That's going to make one incredible botnet. This could potentially bring down AT&T's network or other networks officially locked to Apple products.

Now the question is; whose going to make the first move, the hackers or Apple?

I'm gonna pop some fresh popcorn. This is going to get interesting.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
casiodorus 4th Aug 2010
*I hope this isn't a double post...apologies if it is*

Hackers, spammers and fraudsters are really, really, REALLY going to be enjoying themselves with this one.

I mean...they just need to inject some lovely code in to some vulnerable SQL or Ad servers at popular web sites, and then suddenly *POOF* they can instantly infect practically every Apple iPhone/iPad/Touch in the world.

100 million strong Apple hardware devices eh? That's going to make one incredible botnet. This could potentially bring down AT&T's network or other networks officially locked to Apple products.

Now the question is; whose going to make the first move, the hackers or Apple?

I'm gonna pop some fresh popcorn. This is going to get interesting.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
clloevver 4th Aug 2010
Is this an iOS problem or an Adobe problem? Since the overflow happens with a pdf file?
0 Votes
+ -
What is "safari browser"?
David Scubadiver 4th Aug 2010
I use perfect browser. I wonder if that makes my iPad immune to these shenannigans. Even so, it worries me that my iPad can be used as part of a terrorist plot and I don't even have to click on the file to make it happen. There ought to be a law.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Tim Acheson 4th Aug 2010
Is the author of this article an Apple fanboy? If so, perhaps it would be more convenient if we continue to apply double-standards, and pretend that viruses on Apple products are due to their greatness, while malware on Microsoft products reflect badly on the company.
0 Votes
+ -
Waiting for Apple to
TxM2xTx 4th Aug 2010
deliver free bumper code to fend off these hackers.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
jorjitop 4th Aug 2010
While I am certainly worried that they have discovered a flaw in IOS4, I would be much more worried if I were using Android. Being a more open, and soon to be more widespread platform, and given that its apps will be less controlled, we will soon see a plethora of attacks on Android machines.

Not being a fanboy, just a realist.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
robslusher 4th Aug 2010
First of all Adrian, thank you for bringing this to our attention. This begs the question... what do those of us with iPod touches do now?????
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Den2010 4th Aug 2010
@klumper You are essentially correct - why _do_ we bother? Given what's been coming out of the Black Hat conference, GSM cell phones, passports, PCs, ATMs, and all manner of other digital devices are wide open to anyone who wants to invest just a little time, effort, and money into breaking into them.

The situation is not far from the environment of the sixties, during the Cold War, when we went through air raid rehearsals, practicing "duck & cover," and made sure that our family fallout shelters were well supplied for the day when the bombs would fall. This kind of tension produces one of two responses, it seems. Either we get very paranoid and stress out completely, or we take on the attitude that existed in New Orleans before Hurricane Katrina - something like, "Hey, man, we're all gonna die, so enjoy the ride getting there. Let the good times roll!" And then the storm hits...

Either response is nonsense. The "experts" and "gurus" who saddled us with this insecure mass of junk should be ashamed of themselves for their small-town-naive attitude and where it's gotten us.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
geoff@... 4th Aug 2010
I use Perfect Browser, no issues I am aware so far. However I stay away from sites on which this kind of exploit would be readily available.
0 Votes
+ -
RE: Your iPhone, iPad and iPod touch devices are all wide open to hackers
Den2010 4th Aug 2010
@geoff@... The problem with avoiding likely hostile sites is that _every_ site can be a hostile site. The New York Times site, ESPN, CNN, and a bunch of other totally legitimate sites have been distributors of bad code because ad servers that feed those sites have themselves been compromised. A more appropriate attitude to take is to assume that _any_ site can be the source of badware, and set your PC or mobile device up accordingly. Remember - security in depth...

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix