A major security flaw in Apple’s iOS operating system that could allow hackers to remotely gain unauthorized access to an iPhone, iPod touch or iPad has been uncovered by a security expert "Charlie Miller ".
Charlie Miller gets a kick of out defeating Apple’s security mechanisms, using his hacking skills to break into Macbooks and iPhones. Now, Apple has kicked the security researcher out of its iOS developer program after word got out that he built a proof-of-concept iPhone app to showcase a bypass of the code signing mechanism.
Hours before, a YouTube video that Miller released went viral. In it, he demonstrated how he hijacked an iPhone to run malicious code after installing his Instastock app, which was admitted into the App Store in September.
According to the report, Miller plans to reveal the issue in a presentation at the SysCan security conference in Taiwan next week. As part of his presentation, Miller created an app capable of exploiting the flaw, and uploaded it to the App Store. Though App Store staff discovered a few problem APIs in the app, they didn't notice Miller's use of a special memory area, which allows his app to run unsigned code.
The security expert’s app has since been removed from the App Store and his developer account has been suspended. We've seen plenty of malware on Android, but that's mostly because the Android Market accepts virtually any app and later plucks out the bad weeds. This is a scary first on iOS.
Miller alerted Apple about the weakness three weeks ago. The company acknowledged it and asked how Miller should be credited in a security bulletin that accompanies most iOS release notes. "I'm sure it is something they will fix quickly," Miller noted, suggesting the fix would likely appear before his presentation in Taiwan. "That's what one would hope they would do. I'm sure they are also working on code fixes for the battery draining issue and stuff that they are going to release patch for."
0 comments:
Post a Comment