Apple said it will fix the PDF bug in Safari, which could be exploited to infect iOS devices with malware that gives attackers administrative access to passwords, applications and personal data.
Apple is working on a fix
for the security vulnerability that could potentially allow attackers to
remotely takeover iPhones, iPads and iPod Touches.
The security flaw allows
attackers to infect users' iOS devices with malicious software that would give them
administrator privileges just by displaying infected PDF files, the
German
Federal Office for Information Security warned July 6. Apple did not
provide a timeline for the software update that would patch the vulnerability.
Once the device is
successfully infected, the attacker could access confidential data such as
passwords, online-banking data, calendars, geo-location and emails, as well as
intercept telephone conversations, Germany's information security agency
warned.
"Apple takes security
very seriously; we're aware of this reported issue and developing a fix that
will be available to customers in an upcoming software update," the
company said in a statement on July 7.
The hole was exposed in
JailbreakMe 3.0, a freely available tool
used to unlock iOS devices to run non-Apple-approved applications. The latest
version of the software, released July 5, exploits a flaw in the way Apple's
Mobile Safari Web browser loads PDF files to allow users to easily jailbreak
their devices just by visiting the site. Security experts warned that the same
vulnerability could be used maliciously.
"If visiting the
JailBreakMe Website with Safari can cause a security vulnerability to run the
site's code, just imagine how someone with more nefarious intentions could also
abuse the vulnerability to install malicious code on your iPad or iPhone,"
Graham Cluley, a technology consultant at Sophos, wrote on the
NakedSecurity
blog.
Cyber-criminals can create
booby-trapped Web pages that could, if visited by an unsuspecting user, run
code on the iOS devices, according to Cluley. Apple needs to close this
zero-day vulnerability immediately because leaving it open is "simply
inviting malicious hackers to exploit it," he said.
A hacking group calling
itself the iPhone Dev-Team is behind JailbreakMe, and the vulnerability was
discovered by one of its developers, "Comex." Comex was able to
circumvent two security features built into iOS that are supposed to prevent
attackers from remotely executing code: ASLR (Address Space Layout
Randomization) and DEP (Data Execution Prevention).
ASLR, also found in Windows
and OS X, randomizes the location of key components in the memory address
space. This makes it harder for attackers to find the memory stacks and heaps
in which to run malicious code. DEP blocks buffer overflows that can be used to
load and execute unauthorized code.
The security bug does not
exist on Mac OS X.
JailbreakMe is giving a
"blueprint" to hackers on how to infect devices with malware, Cluley
said. The Dev-Team doesn't think so, writing in the FAQ that the flaw has
"long been present and exploitable."
"I did not create the
vulnerabilities, only discover them," according to the FAQ page.
Comex has issued his own
patch for the hole, which can be applied after running the JailbreakMe tool.
The patch is available as PDF Patcher 2 on the Cydia application store, where
users can download applications that run only on jail-broken devices.
"Normally, I say, for
security purposes, don't jailbreak, but for now I say, jailbreak and install
pdfpatch2 from Cydia," security researcher Charlie Miller wrote on
Twitter.
Ironically, that means users
who run JailbreakMe and apply the patch will actually be safer than the rest of
the users waiting for the official fix from Apple.
"Users are advised to
avoid downloading or viewing PDF files from untrusted sources on their iOS
devices," Intego researchers suggested on the
Mac
Security Blog.
Jailbreaks make iOS more
secure in the long run, the JailbreakMe FAQ suggests, since Apple learns about
zero-day flaws it wouldn't have known about otherwise and can fix them before
cyber-criminals can come up with a malicious exploit. The Dev-Team
exploited a different zero-day vulnerability in the iPhone's mobile Safari
browser about a year ago to create an earlier version of JailbreakMe. Apple
moved quickly to close that vulnerability.
Apple generally addresses
jailbreaking flaws pretty quickly, so it's likely this exploit will remain
"theoretical," the team wrote on the FAQ page.
Apple has been claiming
jailbreaking was illegal since 2009 and voided the warranty on its devices.
However, the United States Copyright office ruled in mid-2010 that bypassing a
manufacturer's protection measures to run "lawfully obtained"
software applications was permissible. Jailbreaking usually requires owners to
connect the device to a computer in order to run the software, but the latest
"untethered" method would allow even casual users to crack the
operating system from the Website.
Email
Print
