As most of you already know, there are two open, critical vulnerabilities in iPhone OS versions from 3.x up. The first one resides in the Compact Font Format component of the PDF renderer and the second one an error in the kernel, allowing attackers to bypass the sandbox (SeatBelt) inside which applications are run on the iPhone.
Only few weeks later the .lnk design flaw on windows (guys, you’re using
LoadLibraryW to load a damn icon!), these iPhone OS vulnerabilities are even more interesting, because of the way the release is being handled by the community and the vendor.
I spent 3 hours last night trying to find detalied information about the bug, and except confused (and propagandistic) blog posts the only bit of information is in this tweet, and in the actual pdf exploit running on jailbreakme.com. Where are the security lists posts? Where is the CVE? Even the CERT still doesn’t say anything about this vulnerability.
There’s something terribly wrong going on: the cat-and-mouse-game that is making the iphone-dev team researchers not disclose any of the vulnerabilities they find has become very dangerous for end users: an exploit that allows remote code execution and jail escape without no interaction whatsoever by the user, carried via something that’s used to consider “safe” (a PDF file) is what is called a critical hole; while the exploit that uses it is called a 0-day. It’s the first time in my life I see a 0-day packaged and distributed explicitly via a web site.
Anyway, the dev-team researchers did not have any other choice: if they had communicated with Apple prior to public disclosure, we wouldn’t have had a so easy jailbreak vector; OTOH now we have vulnerable phones and pads that can be very easily exploited by mailcious parties. It’s also funny that in order to be warned when a PDF is about to be loaded thus mitigating the risk, you should jailbreak your device and install the PDF Loading Warner afterhand.
My stand on this is that the real problem is Apple itself: they’ve crated a walled garden, outside any legislation, where they’re the absolute god and give and take whatever they want. It’s not gonna work forever. I really hope that people will understand think that it’s not the hackers’ fault, rather it’s the totalitarian companies’ fault, for not giving us control over the devices we buy from them. Hackers are only trying to liberate them, and it’s fair use under the DMCA, after all.
UPDATE 2010-10-05: I’ve posted a summary of this bug on the full-disclosure mailing list – you know, if it’s not on FD no one would think about it :-).
- The 2009 social environment
- A bunch of hackers
- Some competent lawyers
- A Google Spokesman
- The Big Brother Awards
- A consistent amount of paranoia
Take the whole social environment, utterly unprepared to the media \(r)evolution happening in the last years, and let the hackers observe and talk/write about it. Bring in the lawyers, and let them recognize that “Houston! We’ve got a problem!”, whilst also they define it via lawspeak. Ask questions, and participate to interesting debates.
Now, deliver the 2007 big brother award to the Google Representative, let the sun dive in the hills, add a noticeable amount of Tuscany red wine, and get ready for the next day. Let the paranoia flow, while the hackers show how you can be traced and found via the cellular network and spied via wifi-networked cameras placed there for your safety.
Watch the undelivered Big Brother Awards 2009 sit on the speakers’ desk and suddenly put on sale on ebay, and go back home, where you read about, and watch, a video-edited interview to the italian PM.
Put everything into the fridge, and give your brain two days to metabolize it. Then write it all LOUD [ .. ]
In the first part I described the morning session, dedicated to the definition of Network neutrality, and how global economics can cope with it. The afternoon was dedicated to more technical talks, and I had the occasion to hear telcos spokesmen remarks over the current situation and possible future developments.
The first speech started at 2.15PM and was held by Prof. Vittorio Trecordi (slides available here). He introduced it by stating that net neutrality could possibly contrast with the economic development and security assessment, because of the wiretapping needed for the latter, tap that is strongly against [ .. ]
Neutrality – “Economy is dematerializing”
Solicited by a Facebook message sent to all the members of the nnsquad.it – for a neutral Internet members on 6 May 2009, I stumbled upon this interesting event I had the occasion to participate, held in the 17th century Rospigliosi palace in the heart of Rome.
The preface looked pretty good: professors, Ph.Ds, telco spokesmen and politicians speaking about the internet, its inborn freedom, and how to cope with this in a society where security measures are constantly increasing, and as such contrast in a virtual world with no barriers whatsoever. Furthermore, it’s a virtual arena in which everything can be free, not only information, and people is becoming accustomed to it [ .. ]
This is my recap of the first italian facebook developer garage, held in milan on April 23, 2009, and hosted by mikamai. The morning has been dedicated to developer sessions, the afternoon to marketing & communication ones. Some videos of the event are available here.
Morning: developer session
The first talk was held by James Leszczenski, facebook engineer, who presented the connect platform vision, mission, and values. interesting, besides the talk, for user participation: the audience was deeply interested about which information they get from facebook, how should they handle it, and which means connect does provide to match identities and find friends on an enabled web site.
( As read on full-disclosure )
Subject: Notice to all employees Date: Tue, 24 Feb 2009 13:06:14 -0500 Dear employees, Due to the current financial situation caused by the slowdown of the economy, Management has decided to implement a scheme to put workers of 40 years of age and above on early retirement. This scheme will be known as RAPE (Retire Aged People Early). Persons selected to be RAPED can apply to management to be eligible for the SHAFT scheme (Special Help After Forced Termination). Persons who have been RAPED and SHAFTED will be reviewed under the SCREW programme (Scheme Covering Retired Early Workers). A person may be RAPED once, SHAFTED twice and SCREWED as many times as Management deems appropriate. Persons who have been RAPED can only get AIDS (Additional Income for Dependants & Spouse) or HERPES (Half Eamings for Retired Personnel Early Severance). Obviously persons who have AIDS or HERPES will not be SHAFTED or SCREWED any further by Management. Persons who are not RAPED and are staying on will receive as much SHIT (Special High Intensity Training) as possible. Management has always prided itself on the amount of SHIT it gives employees. Should you feel that you do not receive enough SHIT, please bring to the attention of your Supervisor. They have been trained to give you all the SHIT you can handle. Sincerely, The Management
( I hope you enjoyed this :) There is also an USAF version from 1997 ).
When you install the developer beta of Windows 7, after the usual 3 reboots cycle, you are greeted with the following image:
It is the Siamese fighting fish, a beautiful tropical fish, but with an interesting characteristic: it is extremely aggressive. It is popular belief that two males fight themselves even in the wild, but that’s not quite true. This belief descends from the behaviour of the fish into an aquarium, where the victor continuously attacking the loser, eventually causing the loser’s death.
Now, think about the software ecosystem as an aquarium. And think about microsoft into this aquarium. The latest release of Microsoft OS has an aggressive fish as its default skin, and it is alone in this aquarium. And there’s no place for anyone else: they’ll fight whoever adversary, even if it’s from the same species.
What’s uncertain is .. they’ll succeed, or not? :). We’ll see!