How The iPhone Was Cracked

LAS VEGAS -- The big iPhone hack has now been publicly presented. Too bad for the bad guys that Apple already patched the bug. Or have they?

Charlie Miller, a researcher with Independent Security Evaluators, took the stage at Black Hat Thursday and explained in line-by-line detail how he exploited the iPhone and why the Mac Operating system that powers the iPhone is easy to attack.

Though speaking at Black Hat Miller noted that he told Apple about the exploit early on.
"I gave them the exploit before anyone else, I gave them the content of the talk and I gave them a patch too," Miller told the audience. "I told them to have the patch out by august 2nd when I was giving the talk, they needed to do it and they decided to do it."

Miller had originally been scheduled to talk about security in Apple's "Leopard" OS for the Mac, but ended up shifting to the iPhone for a number of reasons. For one thing, the fact that Leopard's release has been delayed by Apple. Fundamentally though, Miller argued that the iPhone is just using a stripped down version of the Mac OS so his general line of reasoning still made sense.

"There is a prevailing belief is that Apple is more secure than Windows," Miller said.
But in his view, that belief is misplaced. He said the same reasons why Macs are cool are the same reasons why they are so easy to hack.

"Macs are easy to hack because they are easy to use," Miller said. "To enable them to be friendly they have a lot of setuid root programs."
Additionally Macs have very good crash reporting which makes attacking them even easier than Windows.

"When fuzzing you usually have to monitor a target to know when it has crashed," Miller explained. "On a Mac it … provides a crash report which helps you to fuzz."
Miller argued that exploitation is easy on a Mac since the system is very predictable. Apple doesn't randomize anything, stack, heap, or location of dynamic libraries, which makes it easy to identify attack vectors.

Even worse is the fact that Apple uses open source software that is often several versions behind what the most current releases are. To prove his point, Miller noted that until Apple's Mac OS recent update, the version of Samba, which is a Windows file sharing tool, was several versions out of date and had a remote exploit in it that had been open since February of 2005.
Miller alleged that the way to find a Zero-day (define) bug on a Mac is a simple exercise of finding open source packages that are out of date.

Miller alleged that some of those old open source applications may be on the iPhone though that's not how they found the big iPhone bug that Apple has now fixed.
The iPhone exploit is a heap overflow exploit and Miller explained that he found it the old fashioned way, fuzzing. Fuzzing is a popular technique that does automatic code injection in an effort to brute force compromise an application.

"We fuzzed the iPhone with various javascipt regular expressions containing "[[**]]", " Miller explained. "We then sorted through the crash reports and then eventually found a good bug. It took a couple of days."

Miller and his team also figured out how to use some privacy data stealing shellcode that could read and write to iPhone. He also wrote shellcode that could do other interesting stuff such as trigger the iPhone to vibrate on command.

Even though Miller thinks Macs are easy to hack, he's not anti-Apple.

"Macs have security problems but I still like them and I'm still friends with my Mac."

More...