Security Researcher Reveals iOS Security Flaw, Gets Developer License Revoked ~ Gadget Reviews, Product News, Electronic Gadgets

Trending: Bloggermint Blogger Template

Fat Jump Pro (By SID On)

Developer: SID On Price: $0.99 Version Reviewed: 1.2 Download: here Requirements: Compatible with iPhone, iPod touch, and iPad.Requires iOS 4.0 or later. Located in the Warsow,Poland-SID on an independent mobile application developer has announced a recent update of Fat Jump Pro for the iPhone,iPad and iPod touch.Fat Jump Pro is a fast paced vertical arcade action for the iOS devices.Using the tilt controls the player must guide the jumping,little green hero (a healthy and crispy cucumber) up a never ending series of platforms...

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEheOZX_2fWULSTc9cCEPViLz6CGJ0M-A3PeJDmVhpJSA02I84Z1gef0cif5bu640uxtj9uzh47wf80tpw9as6jGYUVC9hq8orbuI9gZB15pmPjzrI5OgvQquFCHNGUWn2gIEZzzu2HvNJQ/s1600/hello.png

Detectives’ Chase

http://img.148apps.com/images/itms/471/471857988/icon175x175.png

Ticket to Ride Pocket

http://img.148apps.com/images/itms/441/441083639/icon175x175.png

NFL Pro 2012

http://img.148apps.com/images/itms/466/466067444/icon175x175.png

Blood and Glory

Friday, 11 November 2011

Security Researcher Reveals iOS Security Flaw, Gets Developer License Revoked

Security researcher Charlie Miller revealed earlier today that he had found an exploit in Apple's iOS software that allows an App to run arbitrary code. Apple generally approves all code that is submitted to the AppStore and forbids the execution of un-approved code, but Miller discovered a way to bypass this restriction. Forbes writes:

Miller became suspicious of a possible flaw in the code signing of Apple’s mobile devices with the release of iOS 4.3 early last year.
...
The researcher soon dug up a bug that allowed him to expand that code-running exception to any application he’d like.

Beyond discovering the bug, Miller went a step further and actually had an App submitted to the App Store which took advantage of this bug. The App was approved and was able to perform as expected:

Using his method–and Miller has already planted a sleeper app in Apple’s App Store to demonstrate the trick–an app can phone home to a remote computer that downloads new unapproved commands onto the device and executes them at will, including stealing the user’s photos, reading contacts, making the phone vibrate or play sounds, or otherwise repurposing normal iOS app functions for malicious ends.

Shortly after the news broke, Apple revoked Miller's developer account, citing a breach of the developer agreement.

“This letter serves as notice of termination of the iOS Developer Program License Agreement…between you and Apple,” the email read. “Effective immediately.”

Miller plans to present his findings at the SysCan conference in Taiwan next week.
via:macrumors