{"id":470923,"date":"2010-03-25T11:27:00","date_gmt":"2010-03-25T15:27:00","guid":{"rendered":"http:\/\/wmpoweruser.com\/?p=14663"},"modified":"2010-03-25T11:27:00","modified_gmt":"2010-03-25T15:27:00","slug":"iphone-3gs-vulnerable-to-drive-by-data-stealing-hack","status":"publish","type":"post","link":"https:\/\/mereja.media\/index\/470923","title":{"rendered":"iPhone 3GS vulnerable to drive by data-stealing hack"},"content":{"rendered":"<div class=\"tweetmeme_button\" style=\"float: right; margin-left: 10px;\">\n\t\t\t<a href=\"http:\/\/api.tweetmeme.com\/share?url=http%3A%2F%2Fwmpoweruser.com%2F%3Fp%3D14663\"><br \/>\n\t\t\t\t<img loading=\"lazy\" decoding=\"async\" src=\"http:\/\/api.tweetmeme.com\/imagebutton.gif?url=http%3A%2F%2Fwmpoweruser.com%2F%3Fp%3D14663&amp;source=WMPoweruser&amp;style=normal&amp;service=bit.ly\" height=\"61\" width=\"50\" \/><br \/>\n\t\t\t<\/a>\n\t\t<\/div>\n<p><img decoding=\"async\" style=\"display: block; float: none; margin-left: auto; margin-right: auto\" alt=\"iphoneworm\" src=\"http:\/\/wmpoweruser.com\/wp-content\/uploads\/2009\/11\/iphoneworm_thumb.png\" \/><\/p>\n<p>One again an Apple product was the first to fall at the annual CanSecWest Pwn2Own hacking contest. <\/p>\n<p>Yesterday a fully patched iPhone was hijacked and the entire SMS database, including text messages was stolen after simply visiting a specially crafted web page.<\/p>\n<p>Using an exploit which only took 2 weeks to write, Vincenzo Lozzo and Ralf Philipp Weinmann lured the target iPhone to a rigged Web site and downloaded the SMS database in about 20 seconds.<\/p>\n<p>\u201cBasically, every page that the user visits on our [rigged] site will grab the SMS database and upload it to a server we control,\u201d Weinmann explained.&#160; <\/p>\n<p>Even the iPhone\u2019s code signing protection was not sufficient to mitigate the attack.<\/p>\n<p>\u201cApple has pretty good counter-measures but they are clearly not enough.&#160; The way they implement code-signing is too lenient,\u201d said Halvar Flake, a renowned security researcher. <\/p>\n<p>In addition to hijacking the SMS database, Weinmann said the winning Pwn2Own exploit could have easily downloaded the phone contact list, the email database, photographs and iTunes music files.<\/p>\n<p>\u201cWith this exploit, I can do anything that \u2018mobile\u2019 can do.\u201d<\/p>\n<p>\u201cIt was a real world exploit against a popular device.\u201d said Aaron Portnoy, a security researcher at TippingPoint Zero Day Initiative. \u201cThey exfiltrated the entire SMS database in about 20 seconds. It was as if a Web page was loading.\u201d<\/p>\n<p>The iPhone was recently the subject of a <a href=\"http:\/\/wmpoweruser.com\/?p=10463\" >widespread worm attack<\/a> after hackers breached security using a widely known network password present on Jailbroken devices.&#160; On this occasion however all iPhones, not just jailbroken ones are vulnerable, and are awaiting a hopefully urgent patch from Apple.<\/p>\n<p>Via <a href=\"http:\/\/blogs.zdnet.com\/security\/?p=5836\" >ZDNet.com<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>One again an Apple product was the first to fall at the annual CanSecWest Pwn2Own hacking contest. Yesterday a fully patched iPhone was hijacked and the entire SMS database, including text messages was stolen after simply visiting a specially crafted web page. Using an exploit which only took 2 weeks to write, Vincenzo Lozzo and [&hellip;]<\/p>\n","protected":false},"author":6200,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[7,10],"tags":[],"class_list":["post-470923","post","type-post","status-publish","format-standard","hentry","category-news","category-software"],"_links":{"self":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/470923","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/users\/6200"}],"replies":[{"embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/comments?post=470923"}],"version-history":[{"count":0,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/posts\/470923\/revisions"}],"wp:attachment":[{"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/media?parent=470923"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/categories?post=470923"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mereja.media\/index\/wp-json\/wp\/v2\/tags?post=470923"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}