The iPhone SMS Hack Explained 94
GhostX9 writes "Tom's Hardware just interviewed Charlie Miller, the man behind the iPhone remote exploit hack and winner of Pwn2Own 2009. He explains the (now patched) bug in the iPhone which allowed him to remotely exploit the iPhone in detail, explaining how the string concatenation code was flawed. The most surprising thing was that the bug could be traced back to several previous generations of the iPhone OS (he stopped testing at version 2.2). He also talks about the failures of other devices, such as crashing HTC's Touch by sending a SMS with '%n' in the text."
Why OSS needs financial backing (Score:5, Insightful)
Though it hasn't been so directly argued for a while, there is still the belief that OSS is somehow unique and better than closed source software because it engages the lone hacker sitting in his basement writing code in his spare time. What I found interesting was Charlie Miller's take on unpaid effort.
Financial incentive is, despite the feeble arguments to the contrary, still the thing that gets code written (and bugs found). Without paying the developers, Linux never would have gotten to the stage it is now. Yes, the source code is open, but it is primarily because there is a team of developers getting paid to write the OS source code that we have such a great system today.
The hobbyist is still just a user. The real developers do it as their job.
Re:Why OSS needs financial backing (Score:5, Insightful)
Your argument is valid for everything, if you need to build something good you need dedication. And this dedication is only possible with a motivation that is what money is used these days. But believe me there are better motivators than money still today.
Re:Let me guess...the code was in C, right? (Score:3, Insightful)
Almost as never ending as the flow of programmers that don't bother to learn the intricacies of their language.
I think he misunderstood Apple's comment (Score:3, Insightful)
Re:Why OSS needs financial backing (Score:4, Insightful)
OSS doesn't mean "nobody gets paid" it means "a product you are free to modify is superior to a product which is locked-down. Modifications which can be freely shared or incorporated back into the upstream are superior to modifications which are constantly repeated"
With "proprietary" software, the person who does the initial development is often the same as with OSS. But OSS can get those people and whoever else wants to scratch an itch.
It annoys the crap out of me that I can't, for example, write improvements to the software on my set-top box. People essentially turning away free labor because hardware manufacturers can't decide what it is they're selling.
Re:Why OSS needs financial backing (Score:5, Insightful)
No, "real developers" do as much as they can to meet a deadline. No more... but often quite a bit less. ...
Unlike a "professional" who will stop as soon as possible and get the hell out, because there is no reason for any more, and usually reason for less.
Bullshit.
I don't know what cube farm you met these "real developers" of yours at but in my business "professionals" do what it takes to make the customer happy.
Having shipped dozens of commercial products in somewhat niche markets I can tell you that if you want to eat you do a great job and keep doing it, working directly with key customers if necessary to craft tools that will help them do their jobs better/faster/easier.
And being part of a small company means my income is directly based on those of my users, and in this economy it means working my ass off on as many projects as possible to keep the fridge full and shoes on my kids' feet, and each and every one of them has to be near-perfect at V1.0. There is no "fix these known things in a patch after we release."
I've seen more than my share of open source projects where your "non-real programmers" got tired and stopped at the horribly designed config file, or documentation, or at the "well it works good enough for me" part and people should be *glad* to sift through the code to figure out how it works.
*Professional* programmers have to go that extra 20% at the end, which usually takes 90% of the time, to make the software into a polished, finished, product, and we have to do it in such a way to minimize idiot user questions, which *will* happen, so we don't waste all our money dealing with tech support. Your open-source guys can just say "read the source" if you don't understand something.
How's that for generalizations?
Re:more interesting hack hinted at in last paragra (Score:3, Insightful)
Miller mentions using AT commands to the GSM modem to send all the bogus SMS messages. That's nice. Did you know you could do that with any Motorola phone and a serial cable long before the iPhone was a clever idea in someone's head? You can even buy bare GSM modem modules for control and security systems, telemetry, etc... insert your SIM and go.
Could you cause cell network mayhem and/or go to jail for what you're able to do with AT commands? Probably. Look at all the phreaky fun you could (can still?) have with the POTS network and a modem. But it has nothing to do with the iPhone or jailbreaking in particular. Jailbreaking is just opening up the iPhone's OS to user code. Once you've done that, you could get into the other parts of the phone, such as the baseband processor. That's where you unlock the phone or... well, I suppose if you were clever enough to load custom firmware into the baseband, you could do really nasty stuff at the RF packet level to the towers. But again, every model of phone has a baseband, and they're all reprogrammable (that's how carriers lock phones in the first place)
Re:Why OSS needs financial backing (Score:5, Insightful)
Take Gimp for example. It mimics almost everything in Photoshop and it does a great job generally, but there are many things that are just downright glitchy. Things that would never fly in a pay product, but I suspect for OSS, they were categorized as 'good enough' and lowered in priority for other bug fixes. Things like having to sometimes click on a tool 2 or 3 times before it registers or you end up applying the wrong tool. I haven't been using gimp for oh..say more than 2 years give or take, but the problem still exists. Don't get me wrong. I love OSS. Without it I think the quality of P2P software would be poor at best. OSS keeps them on their toes in a way that other P2P software can't. Get it right, or lose out. It doesn't take much to push someone away from a product when you combine cost and poor quality.
OO.o tends to follow in MS's footsteps (scary thought). Although it might excel in some areas like ODF, it simply plays catch-up for the larger product. I think another part of the problem is we the user. I've caught myself far too many times saying "hey, it's free..why complain?".
Re:Jailbreak (Score:2, Insightful)
Ever since the release of the iPhone, I've been quite astounded at what people think of the jailbreak process. Yes, it's great that people can do stuff with their phone that Apple didn't intend. But... The existence of this means that your phone has a security hole.
I seem to recall that the original jailbreak technique was a specially-crafted TIFF image that caused remote code execution. So you'd just go to a website in Safari that had the image, and it would essentially root your phone.
And iPhone users were fine with this! Yeah, my cool iPhone, Apple can do no wrong! When you ask these same people about Apple's security track record, they'll often say it's great. They don't draw the connection between their cool unapproved apps and Apple's laziness and bad engineering.
Maybe the situation has gotten better since this was the case. But it's a pretty clear example of the junction of fanboyism and technical ignorance.
Re:Why OSS needs financial backing (Score:3, Insightful)
Your take on this is... interesting.
Charlie and Collin look for these bugs AS A HOBBY. Not as a job. The reward they get is the response from the talk they deliver at the next conference.
At three bugs (one per platform) they had enough for the conference.
Why did they find these bugs? Because the "professional" developers and QA people either hadn't found them, or the products (ALL of them) were released with known bugs.
All this tells me is that vendors are releasing buggy products. And that there are at least two hobbyists who find it interesting to look for the defects. Why do they do that? I don't know; that's their itch to scratch. Why do the vendors not apply more quality? That would be money.
All of which makes your final comment
"The hobbyist is still just a user. The real developers do it as their job."
rather laughable.
Re:%n (Score:3, Insightful)
The difference between a bug and a vulnerability is the intelligence of the attacker.
Re:Why OSS needs financial backing (Score:3, Insightful)
Flaw was found in Windows Mobile, Iphone and Android.
Android was fixed within days, WinMo shortly after that and the flaw is still present in the Iphone. This is why it's refered to as the "iphone" SMS bug, not just the SMS bug.
You were saying.