It's
a story tailor-made for the fear-mongering subset of news media. This week, a pair of gentlemen lured an unsuspecting virgin iPhone to a malicious website and -- with no other input from the user -- stole the phone's entire database of sent, received and even
deleted text messages in under 20 seconds, boasting that they could easily lift personal contacts, emails and your naughty, naughty photos as well. Thankfully for us level-headed souls, those gentlemen were Vincenzo Iozzo and Ralf-Philipp Weinmann, security researchers performing for the 2010
Pwn2Own hacking contest, and their $15,000 first prize ensures that the winning formula will go to Apple (and only Apple) for further study. Last year, smartphones
emerged from Pwn2Own unscathed even as their
desktop counterparts took a beating, but this makes the
third year in a row that Safari's gotten its host machines
pwned. That said, there's no need for fear -- just a healthy reminder that the Apple logo doesn't give you free license to click links in those oh-so-tempting "beta-test the new iPad!" emails.
posted March 25th 2010 2:36AM
ouch!
@ParkerMB731
Who needs viruses on apple products when you can just exploit them!! Something Apple is fluent with.
@Lamperouge Safari still fails.
@rederikus
troll much ?
@rederikus the blackberry browser DOES take weeks to load pages, so I assume that's what you meant, yeah?
@ParkerMB731 True, brings new meaning to iPwned it in.
@DarkElfa
Now Apple and Apple customers will get a taste of what it's like to be the most popular OS on a platform. Security through obscurity is definitely not a factor with the iPhone.
@DarkElfa
"most" secure is still up for debate, but no one ever said "completely" secure. Thanks for playing.
@ParkerMB731 Nothing is perfect
@DarkElfa Apple relies a bit on security through obscurity. As Apple becomes less obscure, the security needs to be improved. I think we can say that iPhones are not obscure these days. Props to these types of contests that give companies and their customers a chance against malicious hackers.
@ParkerMB731 wait so the results will go to apple for THEM to study? i see that as a lose lose situation for the masses, like:
1.Harder to exploit devices
2.Based on a Cracked article i laughed over, but then was afraid afterwards,(www.cracked.com/article_18377_5-reasons-you-should-be-scared-apple.html) that number one reason seems like that would be implremented in a way like this...(but like reverse.)
@Firehazel
I read that a while ago, scared me too, mainly because it takes apples 'strong points' and blows them to shit, didnt some guy kill himself after being accused of stealing a prototype iphone and his family was threatened?
even so, nice reality checks like these keep apple fanboys in place :)
all it takes is someone willing to hack apple products and look what happens
@zelannii
Don't try to change your game plan now. Just suck it up & everything will be alright.
Now that is some quality photoshop.
@mrjaggs Or some quality Microsoft Paint.
@mrjaggs
I think they did a good job. No need to sugar coat it.
@Air2ground
Nah. Microsoft helps keep CrApple afloat just to avoid anti-trust suits. Without CrApple, MS would have almost 100% of the computing market and and that would cause it problems.
Just lket CrApple keep shooting themselves in the foot, smile and keep using products that actually have worth.
@rederikus
See in your earlier post, where you used 'CrApple'. It may have raised a wry smile. Continuing to use it, 3 times in this post, makes you sound like a trolling tool. Just saying.
@gavmiller I agree, you sound like an insecure fanboy that has an unhealthy aggression towards a company you more than likely no nothing about.
@angermeans
no versus know
No, used as a function word to express the negative of an alternative choice or possibility
Know, to be aware of the truth or factuality of : be convinced or certain of b : to have a practical understanding of
Now you know, and knowing is half the battle. GI JOE!
Owned
That's impossible, those ads on tv tell me that Mac products are super duper ultra secure and they keep the hackers away. You mean, tv ads lie????
@xtasi "Hello, I'm a Mac and I am a PC. We have something very much in common. Only the PC cost twice as less, is upgradeable and you can actually play games on it and you dont have the control issues like you do with Apple.
@Appleblows
Now that would be a HUGE ad campaign idea for MSFT! or PCs in general!
Someone should make a vid for youtube!
@xtasi Actually, the security of a Mac system (or Windows Vista/7) is working here. The hack only allows access to a limited set of abilities because the browser runs as a user "mobile", not as a super-user (like is typically the case in Windows XP).
So the security systems Apple has in place did limit the exposure here. Windows Vista/7 have similar controls. XP does too, but almost no one uses them.
@xtasi Yeah, until it hits a relevant market share. To any one who wants to point to that their market share isn't that much larger and the number of users is less, the point here is that the mobile space is more fragmented and growing faster than any other computing segment.
@spin cycle LOL. Come on, you're ruining the fun all the haters are having. :D
@Appleblows
"and you can actually play games on it"
Macs are meant for people who want to work, not fuck around.
@Raul7
actually, macs are for people who want to fuck around but call what they are doing work
@Raul7 To me, Macs are devices specifically designed to produced those beautiful-looking files, sheets and presentations. I don't really know what else Macs represent.
@Billy I say the same about Winblows. They're gaming systems. Beyond that, they don't offer much. Other than get viruses, malware, and bloatware.
@guroth Now that's funny. Considering Windblows machines are more for gaming. LOL...
I guess the 30 servers, and various Cisco devices, VoIP systems, etc. I support using a Mac isn't work...I'll be sure to let my boss know they're paying for nothing...
@Billy I thought that was just the end result of writing your document using LaTeX? Oh and that's available for all major platforms XD
@xtasi
Apple has many less threats to worry about overall as most hackers go after the majority marketshare. OS X has a relatively secure design but windows is more battle-tested which is also why you hear about more security risks for it. Thinking you are safe just because of your OS is inviting disaster no matter what OS you're using.
@guroth haha, brilliant comment.
On the flip side, I know a couple engineers, professors who use Macs.
...of course they run Windows on them to do *actual* work, but still.
@xtasi curse you internet and your lack of sarcasm font!!!
what I had meant is that regardless of what safeguards are built onto a system, it's only as good as the people that use use. Read up on http://en.wikipedia.org/wiki/Kevin_Mitnick
False sense of security is worse then no security. Many Apple users wrongly believe that they are immune to breaches, after all, that's what the commercials say. So, many of those users don't practice safe computing, they'll click on anything that comes along. Since their system can't possible by hacked in.
He spent two weeks working out the hack and 20 seconds to apply it. I don't think that shows any unusual vulnerability of the iPhone. Some important parts of the article have been left out rather conveniently.
@MosesusedaniPad
It doesn't matter. If Apple wants to say how much more secure they are (especially against Windows) then they should get to work
@MosesusedaniPad
"In the iPhone sandbox, Weinmann said there’s a non-root user called ‘mobile’ with certain user privileges. “With this exploit, I can do anything that ‘mobile’ can do."”
Yeah they did leave some stuff out. It sounds even worse now.
@MosesusedaniPad
Who cares. This is the third time in a row Safari's had its shit shoved in. That's kind of embarrassing.
@MosesusedaniPad
You might expect Engadget to revise the title but nah... gotta bait the Apple haters :P
@MarkAnderson It will never, ever end. For Safari, IE or Firefox. They are all large projects and these people work all year for the pwn2own event. All there has to be is one vulnerability for each of these apps found per year and these people will debut them at this event for the press and rewards it brings.
And since these browsers are complex pieces of code it's unlikely they'll ever be completely vulnerability-free. And once Chrome becomes significant enough to attack, due to market share or due to reward size, it'll happen to it too.
@MarkAnderson
Every browser is vulnerable to something, usually accessed via a link to a malicious web site. Every browser. EVERY SINGLE ONE. Stop bitching about it like Safari is the only one.
@MosesusedaniPad
I absolutely agree. The "iPhone Hacked in 20-Seconds" is just sensationalist journalism that is lapped up by the anti-Apple brigade. Yes, it is important news, and Apple clearly has to take action, but the sky is not about to fall in and I feel no more worried about using my 3GS today as I did yesterday.
The chances are that you could respin this article to something like "iPhone Hacked By Toddler" or "iPhone Hacked By Domestic Cat" if all they had to do was push a button to implement a vulnerability that took weeks of development time and everything to use it was ready and waiting.
Ultimately, I pay no attention to these competitions because they don't bare any resemblance to the "real world".
@MosesusedaniPad
He work out 2 weeks to hack a phone in 20 seconds job. I believe that from now on every iPhone is submitted to be hacked in 20 seconds.
Each 20 second an iPhone is hacked. Every 13 second a child ....
@Jack
I totally agree. That's why we should all agree Macs aren't inherently any more secure than PCs.
I expect Apple will realise this and modify their marketing campaigns accordingly.
Aha. Aha. Aha.
"lured an unsuspecting virgin iPhone to a malicious website"
I wonder what would happen if the same test is done with Android, as both are using Webkit based browsers.
@pika2000
Read the article. It hints at what it uses to exploit. The webkit's implementation has nothing to do with how safari stacks and implements client-side exploits. Two entirely different systems.
@Lamperouge Well I'm too lazy to read it. :P Anyway, the fact that the iPhone can be jailbroken tells you how "secure" it is in general.
@pika2000
Using that logic, my PC running Google Chrome is in trouble too!
Fortunately, it doesn't work like that.