Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

blogs.forbes.com

Post reply on HN
Print view View original

51–60 of 74 posts

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#51

Post by alanh »

conradev wrote: post #39
daimyoyo wrote: post #8

Jailbreakme is an amazingly elegant tool. Although I seriously doubt they will, Apple should definitely hire him. His products show that he understands design as well as anyone on their payroll now. That combined with his obvious coding skills make him the ideal Apple engineer.

> 'His products show that he understands design as well as anyone on their payroll now.' He designed none of the interface. > '... his obvious coding skills ...' A lot of the time, a person's coding skills are judged by how readable their code is, and how well they utilize SCM. Also, to be an Apple engineer you want extensive experience with Objective-C. https://github.com/comex/star_ Now I don't mean to say comex is…

Who cares about design or coding skills? Apple should hire him to help improve security, if only by doing what he does right now and sending results back to another team at Apple!

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#52

Post by pavel_lishin »

sjs wrote: post #47
pavel_lishin wrote: post #20

Earlier quoted context omitted.

Not to mention, it may solve their jailbreak problem, at least temporarily.

I never understand this sentiment. Jailbreak tools thrive on the knowledge that there's always another flaw out there waiting to be discovered. How would comex rid Apple's entire development process of error? Plus, if he jailbreaks devices because he believes people should be free to do with their hardware as they please why on earth would he effectively join the dark side?

> How would comex rid Apple's entire development process of error?

That's why I hedged with "temporarily". If he's the best that's working on jailbreaking now, just taking him off that project would already help. And asking him to work to secure phones would be a great help, too - he could spot potential vulnerabilities before they're shipped.

This won't make the iPhone into a space-shuttle, but it will make jailbreaking harder, perhaps significantly so.

> Plus, if he jailbreaks devices because he believes people should be free to do with their hardware as they please why on earth would he effectively join the dark side?

They'll drive a dump-truck full of money up to his house. Or maybe there's something else he values more than the belief in free hardware.

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#53

Post by jokermatt999 »

Skroob wrote: post #34

So much misinformation. Apple "rushed to patch the security opening" because IT'S A SECURITY FLAW that allows unrestricted code execution via a website. That's a pretty huge problem; shouldn't it be fixed right away? "After Allegra released JailbreakMe 2 last year, Apple upped its game another notch, randomizing the location of code in memory so that hackers can’t even locate commands to hijack them." Another securit…

It's a difficult problem to explain in a typical narrative journalism style. Patching security is a good thing, yes. Being able to do what you want with your own phone, The Man be damned is also a good thing. Now, try to present both sides in a catchy article written for general audiences about a member of the jailbreak community.

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#54

Post by aninteger »

rpearl wrote: post #37
aninteger wrote: post #31

Earlier quoted context omitted.

There's lots of people that work at Apple that help the JB community. Some of them also work on OSX86.

I do not believe you. Who? If you can't list their names, then it's pretty clear that Apple doesn't approve of their actions whatsoever. If you can, then Apple explicitly working to close security holes, not providing a sponsored jailbreak solution, and letting people work on exploiting security holes, seems pretty damn absurd.

Actually I was specifically mentioning the OSx86 project. I just figured that if Apple insiders are helping the OSx86 project they might be helping the JB community as well.

No, you're right I can't list names. Apple does not approve of the OSx86 project.

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#55

Post by funkah »

delinka wrote: post #21

The kind of control Apple seeks (to what purpose is irrelevant) is doomed to fail. You simple cannot control a device once it's in the possession of an 'adversary' (which in this context seems to be the owner of the device). Once the attacker (again, the owner of the phone who wants to jailbreak) has possession of the phone, he has complete control over it. I wonder if Apple has this internal posture that they should…

Depends on your definition of failure.

Looking at sales figures for the app store and iTunes, would you honestly say that Apple's code-signing and other DRM techniques have "failed"?

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#56

Post by potatolicious »

sjs wrote: post #47
pavel_lishin wrote: post #20

Earlier quoted context omitted.

Not to mention, it may solve their jailbreak problem, at least temporarily.

I never understand this sentiment. Jailbreak tools thrive on the knowledge that there's always another flaw out there waiting to be discovered. How would comex rid Apple's entire development process of error? Plus, if he jailbreaks devices because he believes people should be free to do with their hardware as they please why on earth would he effectively join the dark side?

> "why on earth would he effectively join the dark side?"

Money.

> "How would comex rid Apple's entire development process of error?"

It wouldn't - but finding exploits and security holes isn't a matter of course. There aren't altogether that many people who have the talents for it, much less the ability to package it into a coherent tool that normal joes can actually download and use.

I have a feeling that there are few enough people who fit this description that Apple can effectively buy them all out.

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#57

Post by saurik »

Xuzz wrote: post #46
rsynnott wrote: post #42

Earlier quoted context omitted.

Well, they are to a lesser extent; they allow an attacker with physical access (a spouse or colleague, say) to compromise your device. Defending against physical access-based exploits is likely always going to be ultimately futile, though.

Actually, not really. From what I know, the keychain security hasn't been broken, except through brute forcing the passcode. While that's usually possible for the standard 4-digit passcode, it's not always possible. Jailbreaking is a necessary step to get the access necessary to brute force, but it doesn't magically break open the device for full access. (However, I am not an expert at this. I've talked with NerveGas…

A lot of what people are trying to protect is stores in the clear, though: I personally don't want people piking up my phone and stealing my address book and photos. Google's approach to this, a supported "jailbreak" (fastboot oem unlock) that formats the phone as it does its job, is tome the best solution, as it guts the incentives of people like comex to weaponize an exploit so well that any evil idiot can use it (in essence, the only people with the technology would be the "larger evil", as opposed to people like your nephew, ex-husband, or business rival).

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#59

Post by jonknee »

Xuzz wrote: post #48
ghshephard wrote: post #43

Earlier quoted context omitted.

Recent history proves that Apple is not capable of solving the jail breaking problems with their current security organization. If they were, then their Operating Systems wouldn't be broken so quickly.

I think the issue is not their security team, who seem to do quite a good job securing iOS (which I'd consider one of, if not the most, secure consumer operating systems out there). The issue is that securing an OS is hard . It's hard to make it that someone with physical access to the device cannot just run code on it, which is what jailbreaking (in its purest form, on iOS devices) is.

Arbitrary code execution is different than requiring physical access to the device. The JailbreakMe site could have run malicious code and it could have spread itself and run without the user knowing.

Re: Meet Comex, The 19-Year-Old iPhone Uber-Hacker Who Keeps Outsmarting Apple

#60

Post by rpearl »

aninteger wrote: post #54
rpearl wrote: post #37

Earlier quoted context omitted.

I do not believe you. Who? If you can't list their names, then it's pretty clear that Apple doesn't approve of their actions whatsoever. If you can, then Apple explicitly working to close security holes, not providing a sponsored jailbreak solution, and letting people work on exploiting security holes, seems pretty damn absurd.

Actually I was specifically mentioning the OSx86 project. I just figured that if Apple insiders are helping the OSx86 project they might be helping the JB community as well. No, you're right I can't list names. Apple does not approve of the OSx86 project.

Note that "let's run OSX on non-supported hardware of the same architecture" is very importantly distinct from "let's find and exploit security bugs"
Post reply on HN