A security researcher on Tuesday published exploit code for a security vulnerability in Apple's iPhone that can allow a hacker to gain complete control over the popular mobile device.
HD Moore, creator of the open-source Metasploit vulnerability testing tool, posted the code online and said it exploits a buffer overflow flaw in libtiff, the image rendering library that's used by the MobileMail, MobileSafari, and iTunes iPhone applications.
Moore first began to outline the security shortcomings of the iPhone in late September, when he wrote that any security flaw in any iPhone application can lead to a complete system compromise. Last week, Moore noted that only iPhones that had been unlocked were susceptible to the exploit code he'd been developing.
After Apple issued the 1.1.1 iPhone firmware update the next day, which re-locked unlocked iPhones by stripping away third party packages, Moore said the process of writing exploits for the device actually became much simpler.
"Fortunately for the iPhone development community, Apple shipped the iPhone with a vulnerable version of the libtiff library and didn't bother updating it for the 1.1.1 release," Moore wrote.
The flaw, which can be exploited through the MobileSafari Web browser, affects unmodified iPhones running the latest 1.1.1 firmware, as well as the iPod Touch device, according to a security bulletin issued last week by Secunia, which rated the severity of the threat as 'highly critical', or 4 on a 5 point scale.
|
Symantec's Code Red: The Law Enforcement/Anonymous E-Mail Exchange Law enforcement officials negotiated via e-mail for more than two weeks with an Anonymous group member trying to extort $50,000 from Symantec to keep stolen product code off the Internet. |
|
How To Sell IT Security Services To Your Customers Cyberattacks can cost a business thousands, even millions, of dollars, and can deal a death blow to some. Here's how IT solution providers can help guard against malicious attacks. |
|
Cybersecurity Experts: What They Know Could Scare You A recent report based on interviews with security experts in government, business and academia finds more than half in agreement that a worldwide arms race is taking place in cyberspace. |
 More
Slide Shows |
- Insider Threats: The Next Frontier for Security Resellers and SMBs
- Complete Security and Your Bottom Line: Sophos, Value and the Channel
- Tough Threats, Tougher Security: How You Can Leverage New Solutions To Combat A “Targeted Attack” Landscape
- Dark Clouds Ahead: Why the Mid-Market Needs To Ramp Up Cloud Security and How You Can Help Them Get There
