Unpatched iPhone/iPad vulnerability could lead to malicious attacks
Blueprint laid down by JailBreakMe website could assist copy-cat hackers
Singapore. July 11, 2011 – A website that has made it simple for iPhone and iPad users to jailbreak their devices is not just a nuisance for Apple, who want to discourage owners from jailbreaking their devices, but is also a portent for future malicious attacks.
Owners of Apple gadgets, including the recently launched iPad 2, are presented with an easy way to jailbreak them, opening up the possibility of installing apps that have not been approved by the official Apple AppStore.
Normally, jailbreaking requires users to connect their device to a computer before they canstart to tamper with the set-up of their iPhone or iPad and gain access to the Cydia underground app store.
The drive-by jailbreak is possible because the website exploits a vulnerability in the way that the mobile edition of Safari (the default browser used in the iOS operating system) handles PDF files.
Because Apple has not yet patched this latest vulnerability, iPad and iPhone users could be at risk from hackers if they chose to exploit the same vulnerability to install malicious code.
“Cybercriminals would be able to create booby-trapped webpages that could – if visited by an unsuspecting iPhone, iPod Touch or iPad owner – run code on visiting devices without the user’s permission,” said Graham Cluley, senior technology consultant at Sophos. “Apple willbe furious that this vulnerability has been made public in this way, and that they have not yet got a patch to protect their millions of users.”
Sophos’s experts have added detection of the exploit code as Exp/PdfEx-ER, but as Apple does not allow anti-virus software to be listed in the official iPhone AppStore there is no on-device protection available for users.
“A website like JailBreakMe is making it easy to jailbreak your iPhone or iPad – but it could also be said to be giving a blueprint to malicious hackers on how to infect devices with malware,” continues Cluley. “There are many cybercriminals who would love to infect iPhones and iPads, and eyes will now be turning towards Apple to see how quickly they can
issue a patch for iOS to close this vulnerability.”
More details can be found in Sophos’s Naked Security article about the threat at:
http://nakedsecurity.sophos.com/2011/07/06/jailbreakme-security-iphone-ipad/
About Sophos
More than 100 million users in 150 countries rely on Sophos as the best protection against complex
threats and data loss. Sophos is committed to providing security and data protection solutions that are
simple to manage, deploy and use and that deliver the industry’s lowest total cost of ownership. Sophos
offers award-winning encryption, endpoint security, web, email, and network access control solutions
backed by SophosLabs-a global network of threat intelligence centres. With more than two decades of
experience, Sophos is regarded as a leader in security and data protection by top analyst firms and has
received many industry awards.
Sophos is headquartered in Oxford, UK and Boston, US. More information is available at
www.sophos.com.
