Forgot your password?
typodupeerror
Bug Security Apple

Charlie Miller Circumvents Code Signing For iOS Apps 172

Posted by Soulskill
from the you-can-trust-us dept.
Sparrowvsrevolution writes "At the SysCan conference in Taiwan next week, Charlie Miller plans to present a method that exploits a flaw in Apple's restrictions on code signing on iOS devices, the security measure that allows only Apple-approved commands to run in an iPhone's or iPad's memory. Using his method, an app can phone home to a remote computer that downloads new unapproved commands onto the device and executes them at will, including stealing the user's photos, reading contacts, making the phone vibrate or play sounds, or otherwise using iOS app functions for malicious ends. Miller created a proof-of-concept app called Instastock that appears to show stock tickers but actually runs commands from his server, and even got it approved by Apple's App Store." Update: 11/08 02:54 GMT by U L : Not unexpectedly, Apple revoked Miller's developer license.
This discussion has been archived. No new comments can be posted.

Charlie Miller Circumvents Code Signing For iOS Apps

Comments Filter:

"Marriage is low down, but you spend the rest of your life paying for it." -- Baskins

Working...