iPhone 又有漏洞 ... (轉載)

wil-wil

轉載自 -
http://chinese.engadget.com/2009/07/03/apple-patching-nasty-iphone-sms-vulnerability/


                     

上一個 iPhone 的漏洞至今已經有了一年多之久 ... 不幸的消息又來了，近日又有人發現了新的漏洞，讓駭客有機可乘；而這次的功勞，則是歸給這位叫做 Charlie Miller 的 OS X 系統安全專家。

他在新加坡舉辦的 SyScan 論壇中表示，iPhone 最新的漏洞，將讓有心人士，透過 iPhone 上面傳送來 SMS 簡訊取得並執行該手機的 software code，讓其可以透過 GPS 來監測手機位置，甚至還可以將 iPhone 的收音麥克風打開來監聽，或者是將該手機成為分散式阻斷服務攻擊 (distributed denial of service attack) 或殭屍網路的一部分。(後面兩個東東搞不清楚是怎樣了...)

而 Charlie 計畫將會在美國駭客大會 (Black Hat) 上對於整個問題做出詳細的說明，蘋果方面據傳則是預期會在這個月底以前將問題解決。

wil-wil

Apple Patching Serious SMS Vulnerability on IPhone

Apple is working to fix an iPhone vulnerability that could allow an attacker to remotely install and run unsigned software code with root access to the phone.

The attack in question exploits a weakness in the way iPhones handle text messages received via SMS (Short Message Service), said security researcher Charlie Miller, during a presentation at the SyScan conference in Singapore on Thursday. He didn't provide a detailed description of the SMS vulnerability, citing an agreement with Apple.

Miller is an authority on MacOS X security, and is a co-author of The Mac Hacker's Handbook.

The SMS vulnerability allows an attacker to run software code on the phone that is sent by SMS over a mobile operator's network. The malicious code could include commands to monitor the location of the phone using GPS, turn on the phone's microphone to eavesdrop on conversations, or make the phone join a distributed denial of service attack or a botnet, Miller said

Apple is working to patch the vulnerability and expects to have a fix ready later this month, before Miller discusses the attack in greater detail during a planned presentation at the Black Hat USA conference in Las Vegas.

Despite the SMS vulnerability, the stripped-down version of MacOS X used in the iPhone makes it more secure than computers running the full-blown operating system, Miller said.

For starters, the stripped-down version of the OS presents fewer options for attackers, removing applications and features such as support for Adobe Flash and Java, which they might otherwise be able to exploit for vulnerabilities. In addition, the iPhone includes hardware protection for data stored in memory and the phone is designed to only run software code that has been digitally signed by Apple.

The iPhone also requires applications to run in a sandbox, a security feature that isolates them from other applications and limits their access to the phone's capabilities. But SMS offers a way for attackers to get greater access to the phone's capabilities, Miller said.

"SMS is a great vector to attack the iPhone," he said.

Most often used to send brief text messages between cell phones, SMS can also send binary code to an iPhone, which then processes the code without any user interaction. Each SMS message is limited to 140 bytes, but longer sequences can be sent to the phone as multiple messages that are automatically reassembled.

This feature allows larger programs to be delivered to a phone, Miller said.

In addition, vulnerabilities found in the iPhone's SMS function give an attacker root access to the handset, Miller said. That's not the case for the iPhone's other applications, such as its browser, where vulnerabilities only give an attacker access to the application's sandbox.

"The iPhone is more secure than OS X, but SMS could be a critical vulnerability," Miller said.