Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev

Apple iOS 5.0.1 hacked, untethered via two security holes

By Ryan Naraine | January 3, 2012, 10:10am PST

Summary: The ‘Corona’ jailbreak tool latest exploits a pair of iOS security vulnerabilities to bypass Apple’s code-signing requirements.

Using two different security vulnerabilities in Apple’s flagship mobile operating system, a security researcher has released a tool to untether devices running iOS 5.0.1.

The latest jailbreak, dubbed Corona, exploits a pair of security holes — a format string vulnerability and a heap overflow in the kernel — to bypass Apple’s code-signing requirements and untether devices (see video above).

The jailbreak tool has been released at the greenpois0n and the iPhone Dev Team sites.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

2012 resolution: 'Full disk encryption on all computers'

AOL's AIM upgrade introduces 'privacy-unfriendly' features

Topics

Apple Inc., Apple iOS, Mobile Operating Systems, Security, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Full Bio
Disclosure
Contact

Vendor HotSpot

The 360° Conversation around Cloud Computing

TECH VISUALIZER brings the social conversation to life... powered by Brocade

Learn More »

Related Discussions on TechRepublic

Did you know you can take part in these discussions with your ZDNet membership?

Ask a Question Start a Discussion

Comments

Add Your Opinion

Join the conversation!

Follow via:: RSS; Email Alert

Just In

sdfsd

jywhy888 7th Mar

View in thread

Please Select
Please Select

0 Votes

+ -

This is news?

toddybottom Updated - 3rd Jan

iOS is constantly hacked within minutes. It is a swiss cheese operating system.

Reply
Flagged

0 Votes

+ -

so true

use_what_works_4_U 3rd Jan

@toddybottom
November 12 (iOS 5.0.1 release date) was only yesterday, right? Odd how we fit three (or more if you total all population segments) major holidays into the time that it takes to compromise iOS, isn't it?

This is news, not because it was done, but because there are people who have waited over a month and a half for this who might want to know about it.

Reply
Flag

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

Rick_Kl Updated - 3rd Jan

@macadam Its the worst mobile OS (according the zealots) e
Everyone should buy a Man-goo phone, as they are the best. The OS is bullet proof and incapable of being hacked. Just be careful of incoming text messages
wink

0 Votes

+ -

It was hacked within minutes

toddybottom 3rd Jan

@macadam
If you had bothered to read the article:
"Using a fuzzer, I found after some hours of work that there's a format string vulnerability in the racoon configuration parsing code"

It took a few minutes.

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

Peter Perry 3rd Jan

@macadam Doesn't work on the A5... It still only exploits older products!

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

msalzberg 3rd Jan

@toddybottom

NZ, it appears you didn't read either the article or your own words.

"...after some hours of work..."

"It took a few minutes."

0 Votes

+ -

That was a nice try at a defense, did you read what you wrote?

toddybottom 3rd Jan

So it appears that iOS is so secure that it can withstand a few hours of hacking. Way to prove that iOS isn't swiss cheese.

BTW a few hours is also a few minutes, I never specified a number. No matter how you spin it, iOS 5.0.1 fell extremely quickly. It is a swiss cheese OS.

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

msalzberg 3rd Jan

@NZ

Nice try, but you still look foolish. Even more so now.

0 Votes

+ -

sdfsd

jywhy888 7th Mar

Reply
Flag

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

leonbakhan 3rd Jan

This is news and now what will happen? Can anyone say?

Reply
Flag

0 Votes

+ -

Now this is news

toddybottom 3rd Jan

bing: open letter tim cook apple genius

At least the guy was smart enough to leave BEFORE saying anything that wasn't totally positive about Apple. We all know that you instantly get fired from Apple if you make any comment that can be copied (a judge has ruled on this) and isn't totally positive about Apple.

I feel very sorry for Apple geniuses, both past and present. They have been used and abused by Apple and some of them right here on ZDNet suffer from serious Stockholm Syndrome. I won't name any names since I don't want to add to their suffering.

Reply
Flagged

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

pupkin_z 3rd Jan

@toddybottom I like how your comments get flagged by the Apple zombies - a typical RDF approach. It reminds me the communist propaganda in USSR and North Korea.

Reply
Flag

0 Votes

+ -

Interesting observation

use_what_works_4_U 3rd Jan

@pupkin_z
I didn't flag him (this time) but do you suppose that the comment might have been flagged as being off topic since it really has nothing to do with the topic of the blog (iOS5 hacking) and is really just another way tor Toddybottom to sadly try and jab at Apple?

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

use_what_works_4_U 3rd Jan

@toddybottom
I will assume you are talking (at least in part) about me as I have identified myself as a former Apple Genius on numerous occasions. I read the open letter you referenced (an actual link would have been nice 'customer' service but I digress) and I have to say that I agree with the author to an extent. The situation he describes has happened and is happening in some Apple Retail locations, but not all. I know this because I keep in touch with many of my friends who are also former coworkers and we talk about Apple and the stores.

The management of each individual Apple Store has a lot of influence on the environment within that store. There are stores in my immediate area where this situation has occurred from time to time. Fortunately in this area the situation rarely lasts. I have at times recommended that certain Apple Stores be avoided and others preferred for these reasons, but eventually it levels out. I would also add that the situation is often reflective of the overall talents on a given Genius team. If the team has the experience, knowledge, and maturity to handle their jobs well, they are usually left largely alone to run their shop. If not, then the management is forced to insert themselves into the mix and that's when things can get heavy handed. Unfortunately because this is, after all, a mall job it is often filled by young people with good to excellent technical knowledge but not much real-world experience. You see this a lot after a store has been open for a few years. The initial team members tend to move on to 'bigger and better' things and the vacuum is sometimes filled quickly without the necessary mentoring time for new people. The store I worked in went through this about a year after I left. When the last of the original team had gone, the Genius staff were (for a time) all young and inexperienced. At the same time there was a shift in the management team and the incoming managers just didn't understand how important it is to properly service the customers as opposed to simply selling new product. At that time, I recommended that people use a different location for service needs. Within a few months the team became seasoned again, managers settled down and let the support staff give good support and I am now happy to recommend them to family and friends. If I need technical help I would (currently) be happy to go back there myself, and my measure for satisfaction with Apple service is very high indeed.

The author is quite correct in that leaving Apple's employ is a bittersweet moment. The demands of offering free retail support are great and it was a relief to leave the crazy schedules and minority of belligerent customers behind. It was also a sadness to leave a company as dynamic as Apple, and the overwhelmingly greater number of customers who were grateful for our assistance. It was truly one of the toughest, most demanding, and most rewarding positions I have ever held and I miss it. The camaraderie in an Apple store is phenomenal as well.

It's not Stockholm Syndrome, it's the way I still feel about the company after almost 5 years in the corporate environment. Yes, there were bad days, and bad managers, and a lot that could have been better. But the good days outnumbered the bad, and the customers (overall) were some of the best customers a person could ask for. I still miss it to an extent. The greatest rewards come from the greatest challenges, after all.

Reply
Flag

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

grant@... 3rd Jan

As much as it is nice that IOS 5 users now have some degree of freedom, this should not be necessary. Apple really needs to trust their users with their own devices.

Reply
Flag

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

Peter Perry 3rd Jan

@grant@... They can't trust their users not to buy movies, music and apps from other sources so that won't work.

Reply
Flag

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

msalzberg 3rd Jan

@Peter Perry

You forgot to mention the one-button mouse, the lack of right-click, and the DRM on iTunes.

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

Alan Smithie 4th Jan

No A5 hack though

Reply
Flag

0 Votes

+ -

it's always just a matter of time

jailbreakandunlock 3rd Mar

A5 can be jailbreaked and in specific cases even unlocked!

Reply
Flag

0 Votes

+ -

RE: Apple iOS 5.0.1 hacked, untethered via two security holes

Pablos234@... 26th Jan

Why should apple be able to dictate to me, what i can and cannot do with my iphone.
I bought it so its mine!!. Or is it?.
There are 100s if not 1000s of people out there with useless iphones that have been unwittingly updated by there owners on itunes, thinking they are just updating their ios, but apple doesn't warn them that the baseband will be updated at the same time.
This renders any software unlock useless.
That's out of order!!.

Pablo.