Apple
yesterday released
an update to users that patches the PDF flaw in the iPhone
and iPad browsers, which was unveiled 10 days ago. While
providing a convenient route to jailbreak
and then unlock the iPhone iOS 4.0.x devices, it also proved a
serious security risk.
iPhone Dev Team leader Comex within 10
minutes of the Apple patch went live published full
details of the hack, including source code. Looking at
the source, Mikko
Hypponen, chief research officer at antivirus company F-Secure,
commented, "Impressive. And dangerous."
Dangerous,
indeed. Now that the code is in the wild, those customers who
choose not to patch their phones must be very wary of any PDFs or
links they encounter on websites, as it would be elementary to craft
an attack based on Comex's source code.
One
individual, “MTWomg”,
brazenly posted on Twitter, "@comex thanks, using it to make
malicious s*** now."
Famed
iPhone and Mac exploiter Dino Dai Zovi, co-author of The
Mac Hackers Handbook,
chimed in, "Now that @comex released his jailbreak source, any
bets on how long before it is ported to Metasploit?"
Zovi
referred to the Metasploit which black hat hackers commonly use as a
hacking toolkit, despite being intended as a legitimate penetration
testing kit for security researchers.
Only the iPhone 3G,
iPhone 3GS, corresponding iPod Touches, iPad, and iPhone 4 were
patched. Apple left the first generation iPhone and iPod Touch
unpatched and at risk. Interestingly, Apple's desktop Safari
may also be vulnerable to a similar exploit of the FreeType font
engine. No patches have been applied to the desktop browser,
yet.
The iPhone Dev Team calls
Apple out for leaving users of older iPhone hardware out of the
loop:
The only
problem is they outright abandoned iPhone2G and iPod Touch 1G
users! Even though Apple acknowledges in their security
update the severity of these holes, they left iPhone2G and ipt1G
owners high and dry — completely vulnerable to truly malicious
variants of jailbreakme (these variants aren’t out yet, but they’re
sure to come!).
However,
users of jailbroken phones and iPads can download a patch for their
devices running iOS 4.0.1 and iOS 3.0.1 to plug the security hole
directly
from Cydia.
The
official Apple patches for the PDF vulnerability are available here
for iOS 4.0.2 for iPhone and iPod touch and here
for iOS 3.2.2 for iPad.
