Security researcher Charlie Miller revealed earlier today that he had found an exploit in Apple's iOS software that allows an App to run arbitrary code. Apple generally approves all code that is submitted to the AppStore and forbids the execution of un-approved code, but Miller discovered a way to bypass this restriction. Forbes writes:
Miller became suspicious of a possible flaw in the code signing of Apple’s mobile devices with the release of iOS 4.3 early last year. ... The researcher soon dug up a bug that allowed him to expand that code-running exception to any application he’d like.
Beyond discovering the bug, Miller went a step further and actually had an App submitted to the App Store which took advantage of this bug. The App was approved and was able to perform as expected:
Using his method–and Miller has already planted a sleeper app in Apple’s App Store to demonstrate the trick–an app can phone home to a remote computer that downloads new unapproved commands onto the device and executes them at will, including stealing the user’s photos, reading contacts, making the phone vibrate or play sounds, or otherwise repurposing normal iOS app functions for malicious ends.
Shortly after the news broke, Apple revoked Miller's developer account, citing a breach of the developer agreement.
“This letter serves as notice of termination of the iOS Developer Program License Agreement…between you and Apple,” the email read. “Effective immediately.”
Miller plans to present his findings at the SysCan conference in Taiwan next week.
Meanwhile Google is handing out bounties for stuff like this. Because why would you want to get (almost) free help from industry-leading professionals? Submitting it to the App Store probably wasn't the way to go, though.
It's one thing to find a security hole and professionally inform Apple, quite another to write an app to exploit it and announce you will tell the works how to do it in a conference in a week...
Charlie is a smart guy who makes some really stupid decisions.
Professional developers disclose issues in iOS to Apple through secure channels all the time without this media madness.
Wednesday September 27, 2023 1:34 pm PDT by Marko Zivkovic
Significant changes are expected to arrive with Apple's fourth-generation iPhone SE, in terms of both design and hardware, MacRumors has learned. The iPhone SE 4, known internally under the codename Ghost, is expected to receive a new design derived almost entirely from the base model iPhone 14. According to our sources, the iPhone SE 4 will use a modified version of the iPhone 14 chassis...
Tuesday September 26, 2023 12:47 pm PDT by Juli Clover
Apple today released iOS 17.0.2 and iPadOS 17.0.2 updates, with the software coming five days after the releases of iOS 17.0.1 and iPadOS 17.0.1. Today's iOS 17.0.2 and iPadOS 17.0.2 updates arrive as build 21A351 and can be downloaded on eligible iPhones and iPads over-the-air by going to Settings > General > Software Update. Note that iOS 17.0.2 was previously made available for iPhone...
Tuesday September 26, 2023 9:12 am PDT by Juli Clover
Complaints about heat issues with the iPhone 15 Pro models are not related to TSMC's 3-nanometer node that was used for the A17 Pro chip, according to well-respected Apple analyst Ming-Chi Kuo. Kuo says that overheating could be caused by "compromises made in the thermal system design" that allowed Apple to cut down on the weight of the iPhone 15 Pro models. Kuo says that the reduced heat...
Wednesday September 27, 2023 1:57 pm PDT by Juli Clover
Just a week after releasing iOS 17, Apple has seeded the first beta of iOS 17.1 to developers. iOS 17.1 adds some features that Apple promised were coming to iOS 17 in the future, plus it refines and improves some existing features. This guide covers everything new in the first iOS 17.1 beta. Apple Music Favorites You can favorite songs, albums, playlists, and artists in the iOS 17.1...
Tuesday September 26, 2023 10:01 am PDT by Juli Clover
Apple today released macOS 14 Sonoma, the newest version of the operating system that runs on the Mac. macOS Sonoma has been in beta testing for several months, and it is compatible with the 2019 and later iMac, the iMac Pro, the 2018 and later Mac mini, the 2018 and later MacBook Pro, the 2019 and later Mac Pro, and the Mac Studio. The macOS Sonoma update can be downloaded for free on...
Security researcher Charlie Miller revealed earlier today that he had found an exploit in Apple's iOS software that allows an App to run arbitrary code. Apple generally approves all code that is submitted to the AppStore and forbids the execution of un-approved code, but Miller discovered a way to bypass this restriction. Forbes writes:
Top Rated Comments
Charlie is a smart guy who makes some really stupid decisions.
Professional developers disclose issues in iOS to Apple through secure channels all the time without this media madness.
That pretty much explains why he submitted the app for approval.
I have no doubt that many would have said this wouldn't have got through if he simply revealed the flaw without submitting an app.
----------
He submitted the bug to Apple on Oct 17 according to the source article.
No company or person likes to be exploited. Miller should have revealed the findings instead of trying to take advantage of the flaw.