I feel like if this were an Android flaw, I'd see it in the title. Miller was booted from dev for discovering a major flaw in iOS. A hacker can have full access to the phone and personal data by just downloading an app from the App Store. Definitely worth mentioning in the title.
Security researcher Charlie Miller booted from Apple Developer Program
101–110 of 116 posts
Re: Security researcher Charlie Miller booted from Apple Developer Program
#102Earlier quoted context omitted.
So how do you prove that it's possible to get this kind of exploit into the store unless you submit it to the store?
So how do you prove the DDoS vector exists unless you DDoS someone's site? How do you prove the SQL injection vector exists unless you take over someone's site? etc., etc. This was far from a harmless proof-of-concept app, and "I just wanted to prove I could" isn't sufficient justification for it.
Since the only place you can install software on iOS devices is through the store, it is important to demonstrate the attack vector by which it can be gained.
It indicates both a security flaw in the platform itself, and a security flaw in the app store approval process, both should be highlighted.
Re: Security researcher Charlie Miller booted from Apple Developer Program
#103Oops. Watch the number of trojans for OS X go up now.
Re: Security researcher Charlie Miller booted from Apple Developer Program
#104Earlier quoted context omitted.
He did not put users at risk. This vulnerability allows apps to download and execute new code, but that new code is still subject to the app's sandbox. This vulnerability is interesting from a research standpoint, but has zero actual consequences to the security of iOS.
That's not how it's being explained in the popular press. http://www.forbes.com/sites/andygreenberg/2011/11/07/iphone-...
Nowhere in that article do I see them state that the downloaded code is able to escape the sandbox. They certainly imply it pretty heavily, but I can only assume that's due to general cluelessness, or less charitably a desire to sensationalize the story.
Re: Security researcher Charlie Miller booted from Apple Developer Program
#105It's a bad move for apple. A good relationship with the community of security researchers is crucial - they're talented folks and their research results grab headlines. It takes just a tiny amount of corporate humility and public thanks to win their respect, and in return get goodwill. Treating the community badly will get ensure the next guy won't even try to cooperate. Over the last several years, Microsoft's MSRC…
Isn't it considered good security-research practice and just "good manners" to notify the company beforehand and give them a chance to fix the problem before going public and pulling stunts like publicly abusing it, making sure they are publicly humiliated with their pants down?
Judging from the article, he did neither - so don't run crying about "that's so rude".
Re: Security researcher Charlie Miller booted from Apple Developer Program
#106Earlier quoted context omitted.
Running unsigned code is an exploit, my friend.
Why? What can you accomplish by running unsigned code that you can't accomplish by embedding a (e.g.) Python interpreter?
Code signining is a control that is intended to restrict the software that can run to only those apps which have been granted the right to run.
Your second question is a good one, but given is context, it is unrelated. If apple signs a python interpreter, they do so at their peril, for obvious reasons.
Re: Security researcher Charlie Miller booted from Apple Developer Program
#107Earlier quoted context omitted.
In fairness, many of the bugs which enable jailbreaking also represent serious security problems. For instance, the various iterations of web-based exploits fundamentally do represent remote code execution, a serious bug in any browser environment. On any other platform, we'd classify them exclusively as security vulnerabilities; however, on iOS, the user has to take advantage of security vulnerabilities to break int…
s/many/all/
Wrong. The first jailbreak was done because the iPhone trusted the restore mode commands coming from iTunes. The protocol was totally reworked so that the iPhone would only run some canned scripts. This did nothing to improve device security (it pretty much only enabled the jailbreak), but Apple fixed it fast.
Re: Security researcher Charlie Miller booted from Apple Developer Program
#108Earlier quoted context omitted.
Why? What can you accomplish by running unsigned code that you can't accomplish by embedding a (e.g.) Python interpreter?
Code signining is a control that is intended to restrict the software that can run to only those apps which have been granted the right to run. Your second question is a good one, but given is context, it is unrelated. If apple signs a python interpreter, they do so at their peril, for obvious reasons.
Yes, and it's still only running an app which was granted the right to run, it's just that this app now has some extra code in it. Since Apple doesn't really inspect the contents of the apps it signs anyway, this grants no extra capabilities.
Re: Security researcher Charlie Miller booted from Apple Developer Program
#109As a metanarrative, it's very interesting seeing the conflict between the rules followers and the ethics followers here in this thread.
Re: Security researcher Charlie Miller booted from Apple Developer Program
#110Earlier quoted context omitted.
Hold on here. Is Apple expected to know Charlie Miller is a "security guru", and even if they did, why should he be treated any differently? Security researchers should be held to the same standard as regular developers when reporting bugs/flaws. RTM was convicted of a crime because of his curiosity, and here we have a security researcher who knowingly put users at risk. You ask me, Mr Miller got off lightly.
He did not put users at risk. This vulnerability allows apps to download and execute new code, but that new code is still subject to the app's sandbox. This vulnerability is interesting from a research standpoint, but has zero actual consequences to the security of iOS.
In his demo video, he shows a metasploit interpreter downloading the address book. He mentioned it was a different payload, but I don't recall if he said it was a different application.
If it was the same app, then does that imply the sandbox for a stockmarket app allows access to the address book?