SMS vulnerability on iPhone to be revealed today, still isn't patched

Remember that alleged SMS-based security hole on the iPhone allowing evil-doers to execute arbitrary code and do all sorts of nasty crap like create an army of mobile zombies ready and willing to execute a DoS attack? The guy who found it, security expert Charlie Miller, said that he'd reveal the details of it at Black Hat -- and Black Hat's this week. Sure enough, Miller and his cohorts plan to unleash details of the hack today, and while they claim they informed Apple of the problem over a month ago, Cupertino's yet to make a move. We'd stop short of suggesting iPhone owners all turn off their handsets and take themselves firmly off the grid and into a completely disconnected underground bunker the moment the attack becomes public, but if it's as serious as Miller claims, it definitely bumps up the pressure on Apple to get a fix out on the double -- preferably before 3.1 drops.

[exNewt Posted Jul 30th 2009 10:43AM]

What a Mac user means is these actions do not infect a Mac.
opening an infected PDF file
opening an infected JPG file
inserting (not even playing) an infected Sony/BMG music CD
navigating to a Web page
etc. etc.

PLEASE do not say "more viruses are written for PCs, as they have 90% market share". That is as specious as saying, "You know, bank robbers target small rural banks, as there are more of these than Federal Reserve facilities." No, the Fed sites are guarded by guys in body armor carrying automatic weapons. The rural banks are guarded by a button to press to call the local sheriff.

[jackcrack7 Posted Jul 30th 2009 12:17PM]

@exNewt
Is that really the best comparison that you could come up with? With robbing a bank it's done on a case by case basis. Someone doesn't rob every bank at the same time. When someone develops a virus they intend to inflict as much harm as possible with one attempt. Windows does have a larger market share. You don't see terrorists attacking small buildings with few people very often do you? It's because the impact isn't as large as taking out large venues with large amounts of people. The same with viruses. If someone can find a vulnerability in an operating system that is used by 90% of the world, they'll almost always choose that target over one that is 9% of the world.

[MioTheGreat Posted Jul 30th 2009 1:31PM]

>navigating to a Web page

There have been several Safari exploits that required little more than navigating to a webpage.

[dtown123 Posted Jul 30th 2009 1:48PM]

Apple should think out of the box here. Instead of requiring every iPhone user to hook up to iTunes and update, why don't they use the very exploit they'd be removing to push the update out?

[(Unverified) Posted Jul 30th 2009 7:13PM]

Where's your iGod now beeches? *points and laughs at the iT@rds.*

[hey buddy Posted Aug 1st 2009 5:12AM]

What a stupid fantasy. Stay hating, dork.

[simbr Posted Jul 30th 2009 8:12PM]

"We'd stop short of suggesting iPhone owners all turn off their handsets and take themselves firmly off the grid and into a completely disconnected underground bunker the moment the attack becomes public"
Nah, you just need to seal up your doors and windows with red tape. Or so I've heard.

[VanillaSpice Posted Jul 30th 2009 10:48PM]

That same Forbes article also mentions that they are going to demonstrate a similar texting bug in WindowsMobile that also allows complete remote control.

But Engadget only writes about the Apple bug; interesting. And all those strident comments about how bad Apple are, and how evil they are: you all look pretty stupid for slamming Apple and ignoring Microsoft ... it is obvious that you did not bother to read the article or do any research, you just mistook this as an opportunity to bash on Apple, and you let your prejudices blind you to the fact that Apple is not alone in this situation.

And sorry, but I thought all you commentors were going on about Engadget's supposed bias FOR Apple ... if anything, this shows a bias AGAINST Apple.

(But I have, for the record, never believed that Engadget are actually biased for or against any company.)

[(Unverified) Posted Aug 27th 2009 12:30PM]

All of you are pathetic. none of you are important enough for anyone to want to waste their time hacking your iPhone. Get over it. If you hate apple so much why do you have the products and why are you wasting your time here?....