The Mactard iBlog

[Wired.com] Apple claims that hundreds of thousands of iPhones are being used by corporations and government agencies. What it won’t tell you is that the supposedly enterprise-friendly encryption included with the iPhone 3GS is so weak it can be cracked in two minutes with a few pieces of readily available freeware.

“It is kind of like storing all your secret messages right next to the secret decoder ring,” said Jonathan Zdziarski, an iPhone developer and a hacker who teaches forensics courses on recovering data from iPhones. “I don’t think any of us [developers] have ever seen encryption implemented so poorly before, which is why it’s hard to describe why it’s such a big threat to security.”

…

Wondering where the encryption comes into play? It doesn’t. Strangely, once one begins extracting data from an iPhone 3GS, the iPhone begins to decrypt the data on its own, he said.

(Source)

Surprise! Our previous Mac Babe revisits us with not one, but two visually appealing offerings! Here we have the Mac Babe attempting to use both a Macbook and an iPhone at the same time to demonstrate their loyalty to the wonderful world of Apple. Closer inspection reveals that the Babe is not actually doing anything on these devices, but is simply partaking in the Mactard pastime of merely ‘dicking around’ for the sake of it.

Nice artwork by some guy named Jonathan Brogdon.

Of course, the instructions had to have been added for a reason…

July 2, 2009 - Apple is working to fix an iPhone vulnerability that could allow an attacker to remotely install and run unsigned software code with root access to the phone.

The attack in question exploits a weakness in the way iPhones handle text messages received via SMS (Short Message Service), said security researcher Charlie Miller, during a presentation at the SyScan conference in Singapore on Thursday. He didn’t provide a detailed description of the SMS vulnerability, citing an agreement with Apple.

…

The SMS vulnerability allows an attacker to run software code on the phone that is sent by SMS over a mobile operator’s network. The malicious code could include commands to monitor the location of the phone using GPS, turn on the phone’s microphone to eavesdrop on conversations, or make the phone join a distributed denial of service attack or a botnet, Miller said

Apple is working to patch the vulnerability and expects to have a fix ready later this month, before Miller discusses the attack in greater detail during a planned presentation at the Black Hat USA conference in Las Vegas.

…

(At this point, the iTard in the Miller speaks out)

Despite the SMS vulnerability, the stripped-down version of MacOS X used in the iPhone makes it more secure than computers running the full-blown operating system, Miller said.

…

In addition, vulnerabilities found in the iPhone’s SMS function give an attacker root access to the handset, Miller said. That’s not the case for the iPhone’s other applications, such as its browser, where vulnerabilities only give an attacker access to the application’s sandbox.

…

(And finally, in a double meaning gaffe…)

“The iPhone is more secure than OS X, but SMS could be a critical vulnerability,” Miller Captain Obvious said.

(Source)