iPhone Security: SMS Database Owned in Seconds

The exploit, which was demonstrated at Pwn2Own contest at CanSecWest and targets a non-root user named "mobile" is able to access SMS data, including previously deleted messages according to ZDNet. The exploit relies on a chained return-into-libc, a reasonably common buffer overflow attack.

The data that could be stolen by attacking Safari includes the phone contact list, the email database, photographs and iTunes music files.

Apple is sure to release a patch soon, but the underlying issue with code signing and stack protection is likely to remain. The important question is whether Apple will fix their approach to stack protection and will futher lock down the access provided to their browser user.

The Speedy Evolution of iPhone Worms

The popularity of iPhone worms targeted at jailbroken iPhones with the original SSH password that I described recently continues to grow. The exploits have also become more threatening, moving from the Rickrolling ikee worm (whose creator was recently hired by an Australian iPhone software development Mogeneration) to the more threatening worms, including one that grabs your private data from the phone.

In chronological order so far worms have been:

• Held iPhones hostage for 5 euros (November 2nd, ihacked)
  
• Rickrolled affected users (November 8th, ikee)
  
• Stolen personal data such as contacts, email, SMS messages, photos, music, and other users data (November 10th, iPhone/Privacy.A)

Of note, Sophos provides a very nice writeup and commentary on ikee.

Of course, as theappleblog notes, this threat could be much worse in future generations, as the technique is quickly improved and as more iPhone aware coders take advantage of the platform. Right now, a lot of the techniques used by Windows worms haven't shown up - the self replication capabilities are rudimentary, if there at all, and the concealment methods are largely simply based on file location.

The good news continues to be that the worms only go after phones with the default jailbroken SSH password, and that changing that password on a jailbroken phone will prevent the exploit. The bad news is that malware writers are likely now building toolkits that will easily integrate with the next iPhone exploit - and all that is really needed is an OS level vulnerability that can be remotely exploited to make iPhones a treasure trove of data for successful attackers.

The iPhone will continue to be an attractive target, both because of the desire of the user base to expand the phone's capabilities via jailbreak, and because of the user data and network access that a hacked iPhone can provide. I expect to see more concerted attacks on the iPhone's OS and applications over time, meaning that security and IT staff can expect to have new threats appearing on their networks - pocketable devices scanning for other devices and infecting each other may very well be our next big user initiated threat vector.

First iPhone Worm in the wild - for Jailbroken iPhones only

PMP Today reports that the first iPhone targeted worm is hitting jailbroken iPhones due to a standard SSH password. The worm is a mobile device Rick Roll, resulting in a Rick Astley photo being set as the phone's background.

The easy fix is, of course, to not use a default SSH password - "alpine" wasn't exactly a good password to start with.

IPhone Security FAQs

Creative Commons licensed image courtesy dailylifeofmojo

iphonelinksandfaqs.com has a number of useful including details on iPhone password options using both Exchange and local configuration capabilities, remote wipe, content and application restrictions and more.

The iPhone still doesn't have quite the same depth of security tricks that Blackberries do, but they're starting to get there.

iPhone Security: is the iPhone's security model a threat in your enterprise?

Creative Commons licensed image courtesy Refracted Moments.

SearchMobileComputing's Lisa Phifer interviewed McAfee research scientist Jonathan Zdziarski in a recent article. Zdiarski has done extensive work with iPhone forensics, and points out a number of the major issues with iPhone data security including:

• The easy with with the passcode can be bypassed
• The lack of secure deletion, either via a native utility or an App store application
• Lack of encrypted filespace based on a key in the OS partition
• Unencrypted data synchronization

If you're facing iPhone usage in your organization, this article is one of the better recent overviews. For now, following the CIS iPhone security benchmark draft may be your best bet if you have to support iPhones.

IPhone Pwnage and bypassing the security code

Wired's coverage of Jonathan Zdziarsk's IPhone hack which I mentioned the other day notes that the Pwnage tool can be used in combination with a custom firmware to access the phone without the code. While a local only exploit, it does give forensic investigators a potential way into locked phones without using any special hardware. O'Reilly's webcast of the event is not available yet.

Zdiarski also spoke about the cache retained for fade transitions on the phone. These leave remnant data, which can be recovered, and would show data that users might expect would not still reside on the phone - anything on screen when a transition was prepared would be recoverable.

This emphasizes the need for a secure erase capability on the phone - something that is obviously lacking in the current implementation.

IPhone Security Bypass Fix: Coming in September

Computer World cites an Apple representative as stating that a fix for the security bypass using the home button that I posted about on Wednesday will be available in September.

"The minor iPhone security issue, which surfaced this week, is fixed in a software update which will be released in September," said Apple spokeswoman Jennifer Bowcock in an e-mail Thursday.

Computer World also notes that the same issue was patched prior to the 2.0 release - patched versions were available in January 2008. Patch regression like this is a serious concern for enterprise and home users alike.

IPhone: In An Emergency, Expose All Of My Contact Data

Gizmodo reports by way of Mac Rumors that simply hitting "Emergency Call" on a locked IPhone can allow access to contacts, email, Safari, and SMS, without knowing the user's passcode.

1. Select emergency call from the lock screen.
2. Quickly double tap the home button.

I've verified this, and it does work - the trick was hitting the home button quickly.

This can be avoided by setting the Home button default:

1. Click on Settings.
2. Click on General.
3. Click on Home Button.
4. Make "Home" or "iPod" our default selection.

With a large number of IPhone users in my organization, I'm sure I'll get some mileage out of this one.