Have a PIN on your iPhone? Ubuntu can walk right past it.

[thewayne]

If you're running Lucid Lynx v10.04, plugging your iPhone mounts it as a USB device and you have total access to the data on the phone.

"This, quite honestly, is a staggering flaw. It basically allows anyone capable of driving a Linux PC to copy data off of an iPhone without the owner of the phone having any idea whatsoever that this has happened.

What’s more worrying is that Marienfeldt and Herbeck think that write access to the iPhone is only a buffer overflow away, which means serious access."

http://www.zdnet.com/blog/hardware/ubuntu-lucid-lynx-1004-can-read-your-iphones-secrets/8424

http://apple.slashdot.org/story/10/05/27/1826207/iPhones-PIN-Based-Security-Transparent-To-Ubuntu?art_pos=24


There was a recent article about smartphones being seized by law enforcement organizations (LEO) and the potential for the phone to be remotely ordered to wipe itself. I know iPhones and Blackberries can do this. So they're talking about LEOs using needing to use Faraday Cage bags and rooms to examine the phones after they make sure to remove the battery when they seize the phone. Of course, the iPhone is a sealed unit and the battery cannot be removed.


Apple claims: "iPhone 3GS protects data through encryption of information in transmission, at rest on the device, and when backed up to iTunes."

In the past I used a Palm Pilot extensively and had a program called CryptoPad that used Blowfish encryption and I knew the backup was also encrypted which required a desktop version of the program to access the backups. I've been looking for an encryption product for the iPad Touch which has become my daily use PDA, so this really bothers me that I can't encrypt things and have confidence that they're secure.

Apparently Apple's encryption and business-level security is badly flawed. And that sucks.

http://marienfeldt.wordpress.com/2010/03/22/iphone-business-security-framework/

http://www.wired.com/gadgetlab/2009/07/iphone-encryption/

Comments

[greyweirdo.livejournal.com]

I sort of have a feeling we're going to see a lot more Apple Security issue stories in the near future. I remember reading some article about a year or so ago where this security expert said Apple's are just as vulnerable as Windows boxes, just in different ways, but that the fact that they had such a small market share prevented anyone from bothering. Anyway, this guys said that if and when they started getting a bigger chunk of the market, we'd find that it was worth the time and trouble.

Seems like that's happening now.

[thewayne.livejournal.com]

That's a definite possibility. It used to be that a lot of vulnerabilities were based mainly on how you used your computer. If you didn't download files from suspicious places or open every attachment that people sent you, you were pretty safe.

That's now changed, particularly with cross-site scripting exploits and the ability for a site to download an exploit that will directly compromise your system.

I've never had a virus or trojan on any of my computers, personal or work, because of my computer habits. I've been attacked successfully once: my (then) laptop (Win XP with a Zone Alarm firewall and anti-virus) had a program installed that I knew had a hack but I didn't think the exploit applied to me. It did. Someone was able to use it to uninstall my anti-virus and was working on my firewall when I realized what was happening and yanked my wireless card out of its socket. That's the only time I've been hacked.

Macs have been safer in that they were too small of a market share to be worth exploiting, but I read something today that said they are the dominant player in the laptop market above $1,000. I find that interesting, and I know the laptop that I'm typing this on (a Mac) definitely cost more than $1,000.

Since Macs are based on Unix, I think they are inherently more secure and difficult to hack than Windows boxes. But if you look at the annual Pwn 2 Own competitions (http://en.wikipedia.org/wiki/Pwn2Own), Macs are compromised very quickly under strict circumstances that loosely resemble real-world circumstances. But every platform ends up compromised.

The desktop market is overwhelmingly Windows, and is likely to stay that way. In mobile phones, I read today that the iPhone has over 3.4 million units sold, so that's pretty substantial.

I didn't buy my Mac for security, I bought it for stability. I've had 3-6 OS-level crashes in the almost 3 years that I've had it. The longest it's been up without a reboot was almost 70 days, I'm very happy about that. If I were paranoid about security, I'd be running the NSA's version of BSD with mega-locked-down services. But the more locked-down a computer is, the less flexible it becomes because you can only use vetted software and services.

[silveradept]

Well, that's clearly a problem. Although kind of awesome as well. I wonder whether someone in the Ubuntu department just wanted to write something that would let them access their iPhone without having to deal with encryption and just let it go through.