Register Guidelines E-Books Search Today's Posts Mark Forums Read

Go Back   MobileRead Forums > E-Book Readers > Apple Devices

Notices

Reply
 
Thread Tools Search this Thread
Old 08-03-2010, 12:53 PM   #1
vaughnmr
Ebook Reader
vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.
 
Posts: 604
Karma: 3205128
Join Date: Nov 2009
Location: Texas
Device: Kindle 3, HTC Evo, HTC View
Security threat with iOS 4 and iPad and pdf's

Oddly enough, this is how the new jailbreak works.

http://gizmodo.com/5603319/new-apple...to-your-iphone
vaughnmr is offline   Reply With Quote
Old 08-03-2010, 01:06 PM   #2
murraypaul
Interested Bystander
murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.murraypaul ought to be getting tired of karma fortunes by now.
 
Posts: 3,224
Karma: 10210627
Join Date: Jun 2008
Device: Sony PRS505, Nook Color(CM7), iPad3
Interesting how the same exploits turn up again and again.
You could 'jailbreak' a PSP with a TIFF exploit, and an XBox with a font one.
murraypaul is offline   Reply With Quote
 
Advertisement
Old 08-03-2010, 01:09 PM   #3
kjk
.
kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.
 
Posts: 3,408
Karma: 5647231
Join Date: Oct 2008
Device: never enough
Not that odd, actually-almost all the jailbreaks are based on security holes in the OS. This one seems pretty serious though.
kjk is offline   Reply With Quote
Old 08-03-2010, 01:12 PM   #4
vaughnmr
Ebook Reader
vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.
 
Posts: 604
Karma: 3205128
Join Date: Nov 2009
Location: Texas
Device: Kindle 3, HTC Evo, HTC View
Quote:
Originally Posted by kjk View Post
Not that odd, actually-almost all the jailbreaks are based on security holes in the OS. This one seems pretty serious though.
Is it in the iOS or is this an Adobe thing?
vaughnmr is offline   Reply With Quote
Old 08-03-2010, 01:16 PM   #5
kjk
.
kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.
 
Posts: 3,408
Karma: 5647231
Join Date: Oct 2008
Device: never enough
Quote:
Originally Posted by vaughnmr View Post
Is it in the iOS or is this an Adobe thing?
Apple uses their own PDF stuff, not Adobes-pretty sure this is their issue.
kjk is offline   Reply With Quote
Old 08-04-2010, 07:26 AM   #6
Bremen Cole
Wizard
Bremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with othersBremen Cole plays well with others
 
Bremen Cole's Avatar
 
Posts: 1,115
Karma: 2718
Join Date: Dec 2009
Location: Texas
Device: iPad
After listening for years to Apple folks talking about how secure their products were, it is interesting that the more popular Apple becomes, the more security issues they have. Windows has been maligned for decades for this kind of thing. Looks like folks like me were right, the hackers didn't mess with Apple because of their relative tiny market share. Looks like that's changing.

Since I have never used virus or adware "protection" in 20 years of Windows use, I'm not to worried about stuff like this. I even have the firewall/defense crap turned off in Windows, and never had any problem..... It actually looks like something like this could be more dangerous to someone like me than the run of the mill Windows virus....
Bremen Cole is offline   Reply With Quote
Old 08-04-2010, 11:18 AM   #7
vaughnmr
Ebook Reader
vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.
 
Posts: 604
Karma: 3205128
Join Date: Nov 2009
Location: Texas
Device: Kindle 3, HTC Evo, HTC View
I believe a lot of the "security" was because they were in the minority and weren't being targeted. With the popularity of iOS and Android increasing, I suspect a lot of folks will be caught unaware.
vaughnmr is offline   Reply With Quote
Old 08-04-2010, 11:27 AM   #8
John F
Wizard
John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.John F ought to be getting tired of karma fortunes by now.
 
Posts: 2,369
Karma: 8581888
Join Date: Feb 2009
Device: Kobo Glo
Could someone explain (at a high level) how this security hole could cause trouble. They mention "stack overflow" and "code in an embedded font" in the article, but I don't see why that code would be executed.

I'm a high level programmer, so you don't dumb it down too much.
John F is offline   Reply With Quote
Old 08-04-2010, 12:03 PM   #9
kjk
.
kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.kjk ought to be getting tired of karma fortunes by now.
 
Posts: 3,408
Karma: 5647231
Join Date: Oct 2008
Device: never enough
Quote:
Originally Posted by John F View Post
Could someone explain (at a high level) how this security hole could cause trouble. They mention "stack overflow" and "code in an embedded font" in the article, but I don't see why that code would be executed.

I'm a high level programmer, so you don't dumb it down too much.
http://www.f-secure.com/weblog/archives/00002002.html
http://www.vupen.com/english/advisories/2010/1992

Quote:
The first issue is caused by a memory corruption error when processing Compact Font Format (CFF) data within a PDF document, which could be exploited by attackers to execute arbitrary code by tricking a user into visiting a specially crafted web page using Mobile Safari.

The second vulnerability is caused by an error in the kernel, which could allow attackers to gain elevated privileges and bypass sandbox restrictions.

Note: These flaws are currently being exploited by jailbreakme to remotely jailbreak Apple devices. The website redirects the browser to the appropriate PDF exploit file depending on the device model and version and then executes a first stage payload. Once done, a second stage payload is executed to gain root privileges on the device by exploiting the kernel vulnerability.
kjk is offline   Reply With Quote
Old 08-04-2010, 02:51 PM   #10
Maggie Leung
Wizard
Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.
 
Posts: 1,449
Karma: 58383
Join Date: Jul 2009
Device: Kindle, iPad
If a device was hacked, how could a non-techie tell? Would there be signs, or do you have to run some sort of diagnostic?
Maggie Leung is offline   Reply With Quote
Old 08-04-2010, 04:02 PM   #11
=X=
Wizard
=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.=X= ought to be getting tired of karma fortunes by now.
 
=X='s Avatar
 
Posts: 3,672
Karma: 12205348
Join Date: Mar 2008
Device: Galaxy S, Nook w/CM7
Quote:
Originally Posted by Maggie Leung View Post
If a device was hacked, how could a non-techie tell? Would there be signs, or do you have to run some sort of diagnostic?
It's not easy to tell even for tech savvy folks. Usually only well know hacks are known but the good ones go some time w/o visibility. The best solution for non tech folks is virus scanners, but there is none available for phones.

But I'm thinking in a few years, with the growth of smart phones that should change.

This is Blackberrys biggest selling point, the security on those phones is excellent.

=X=
=X= is offline   Reply With Quote
Old 08-04-2010, 04:04 PM   #12
Maggie Leung
Wizard
Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.
 
Posts: 1,449
Karma: 58383
Join Date: Jul 2009
Device: Kindle, iPad
Quote:
Originally Posted by =X= View Post
It's not easy to tell even for tech savvy folks. Usually only well know hacks are known but the good ones go some time w/o visibility. The best solution for non tech folks is virus scanners, but there is none available for phones.

But I'm thinking in a few years, with the growth of smart phones that should change.

This is Blackberrys biggest selling point, the security on those phones is excellent.

=X=
Rats, thought that might be the case. Thanks for the explainer.
Maggie Leung is offline   Reply With Quote
Old 08-04-2010, 05:49 PM   #13
vaughnmr
Ebook Reader
vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.vaughnmr ought to be getting tired of karma fortunes by now.
 
Posts: 604
Karma: 3205128
Join Date: Nov 2009
Location: Texas
Device: Kindle 3, HTC Evo, HTC View
The government of Germany is now warning about two serious threats in Apple software:

http://www.cbsnews.com/stories/2010/...tionContent.11
vaughnmr is offline   Reply With Quote
Old 08-04-2010, 06:02 PM   #14
Maggie Leung
Wizard
Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.Maggie Leung beat Jules Verne's record by 5 days.
 
Posts: 1,449
Karma: 58383
Join Date: Jul 2009
Device: Kindle, iPad
Quote:
Originally Posted by vaughnmr View Post
The government of Germany is now warning about two serious threats in Apple software:

http://www.cbsnews.com/stories/2010/...tionContent.11
Sounds like these are the same two weaknesses mentioned earlier in this thread.
Maggie Leung is offline   Reply With Quote
Old 08-05-2010, 05:37 AM   #15
toddos
Guru
toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.toddos ought to be getting tired of karma fortunes by now.
 
toddos's Avatar
 
Posts: 694
Karma: 822675
Join Date: May 2010
Device: Kobo Aura, Nokia Lumia 920 (Freda)
Once you've used this security hole to jailbreak your device, install the PDF Loading Warner tweak from Cydia to prevent other sites from exploiting the hole silently. This will make Safari warn you any time it's about to open a PDF file, so if you didn't just explicitly tell it to open a PDF you would've been hacked without this in place (of course if you say "Yes", you'll be hacked anyway).
toddos is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Forum Jump

Similar Threads
Thread Thread Starter Forum Replies Last Post
PDF's in kindle app on ipad???? mack 120 Amazon Kindle 5 08-13-2010 08:27 PM
iOS 4.0.2 (iPhone) 3.22(iPad) updates now available kjk Apple Devices 5 08-12-2010 11:21 PM
FBI investigating iPad 3G security breach / FCC also concerned =X= News 35 06-19-2010 02:47 PM
iPad BoingBoing: Report: AT&T security breach exposed 114k iPad users kjk Apple Devices 9 06-14-2010 01:09 AM
Monthly Magazine PDF's - Is The iPad My Only Option?? Rex32 Which one should I buy? 2 05-30-2010 08:01 AM


All times are GMT -4. The time now is 10:33 PM.


MobileRead.com is a privately owned, operated and funded community.