Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
IOS Iphone Security Apple

Metasploit 3.7 Hacks Apple iOS 68

Posted by timothy from the your-choice-of-options dept.
An anonymous reader writes "HD Moore is at it again. This time the famous open source security researcher has set his sights on exploiting Apple iOS. The Metasploit 3.7 release includes 35 new attack modules in total."
This discussion has been archived. No new comments can be posted.

Metasploit 3.7 Hacks Apple iOS More

Metasploit 3.7 Hacks Apple iOS

Comments Filter:

  • It's time (Score:3, Insightful)

    by symbolset ( 646467 ) * on Saturday May 07, 2011 @03:02AM (#36055090) Journal
    Now that Apple has garnered hacker interest, let's see how they do.
    • In fact I'm curious about this too. The iphone/itunes link means that you can infect one and get the other as bonus. Additionally phones give more vectors of infection. You carry them around and connect them to several different networks. This has to be appealing for exploiters(tm).

    • Because Apple hasn't attracted any interest in the past decade during its meteoric rise in popularity ? Please. The year of the "Mac Attacks" had been coming for almost as long as the year of the Linux desktop.

      • Re:It's time (Score:4, Informative)

        by mjwx ( 966435 ) on Saturday May 07, 2011 @09:13AM (#36056106)

        Because Apple hasn't attracted any interest in the past few years during its moderate rise in popularity?

        There, fixed that for you. Apple's have only gotten out of the 2% of computers in the last 2 or 3 years. Even now they struggle to get 5% worldwide.

        Now back onto topic, as a clued in /.er will always point out, malware is a business and business take a long time to react to changes in the marketplace. Malware attacks on phones are new, very new as there was
        A) Never a market for phone malware.
        B) Phones were never powerful enough to be useful.
        C) Too many different types of phones to make any attack worthwhile. Cost would have been way too high to get every single Symbian model out there.

        Take note of the last one. IOS drops that cost a lot, making malware on phones economically viable. Further more, IOS has proven itself to be quite vulnerable in the past, you do know that jailbreaking is done by exploiting a vulnerability dont you. Feel free to use the "jailbreak me" PDF vulnerability as an example. The only reason it hasn't been exploited is because there's more profit in Windows malware.

        Claiming you are automagically protected when you've never even been attacked is naive at best. It's like Lisa's (Simpson) tiger repelling rock, you cant use the fact that there are no tigers around the rock as proof of it's tiger repelling abilities.

        • Apple's have only gotten out of the 2% of computers in the last 2 or 3 years. Even now they struggle to get 5% worldwide.

          This Ars Technica article [arstechnica.com] has Apple at 10% market share in the US, this one [pingdom.com] has it at 14%. That's a lot of macs. Apple is one of the few companies that have consistently seen their market share grow the last few years in a floundering market.

          Then there's Apple's strength in certain niches, like on college campuses [dailyprincetonian.com] :

          "According to the Office of Information Technology (OIT), 45 percent of computers purchased this year were Macs, more than in any previous year. In 2003, when this year's seniors arrived on camp

        • Re: (Score:1)

          by Anonymous Coward

          This is off-topic, of course, but I want to chime in. I predict that Apple is about to see a meteoric rise in popularity for their desktop operating system. I have been using Ubuntu since Windows 98 stopped getting security updates, July 2006. In my latest computer upgrade, I decided to try OS X because I have found my iPod and iPad so easy to use (and I wanted to run iTunes). I built a hackintosh with the feeling that I could just install Ubuntu if it didn't work out.

          I hated it. I couldn't get used to anyt

  • Metasploit 3.7 Hacks Apple iOS (Score:5, Insightful)

    by Anonymous Coward on Saturday May 07, 2011 @03:09AM (#36055106)

    No, it doesn't.
    It just has something to do after you broke in yourself now.

    • Re:Metasploit 3.7 Hacks Apple iOS (Score:5, Interesting)

      by clang_jangle ( 975789 ) on Saturday May 07, 2011 @03:47AM (#36055202) Journal
      FTFA:

      "The post-exploitation modules (post for short) are designed to run on systems that were compromised through another vector, whether its social engineering, a guessed password, or an unpatched vulnerability," HD Moore, Rapid7 chief security officer and Metasploit chief architect told InternetNews.com. "This module requires iTunes to be installed and for a backend to be accessible that has not been encrypted."

      Correct. Slashvertisements are annoying enough, at least they should be reasonably accurate. This one falls into the "sensationalist blurb" category.

    • Re: (Score:2)

      by pspahn ( 1175617 )

      I wish I knew what this +5 insightful comment meant.

    • Re: (Score:2)

      by tlhIngan ( 30335 )

      Darn. I thought there were 35 ways to jailbreak the iPhones these days. Perhaps one of them would work on the iPad2 (which is still lacking a jailbreak).

      (Jailbreaking relies on vulnerabilities typically)

  • Sites, Sights (Score:4, Informative)

    by mikael_j ( 106439 ) on Saturday May 07, 2011 @03:11AM (#36055110)

    "Set his sites"? really?

    • Damn you for implying that timothy should proof-read submissions! Heretic!

  • Not an iOS Exploit In And Of Itself (Score:5, Informative)

    by rsmith-mac ( 639075 ) on Saturday May 07, 2011 @03:39AM (#36055182)

    The Apple iOS Backup File Extraction module however is not an attack vector for directly exploiting iOS. Rather it is what is known as a post-exploitation module.

    "The post-exploitation modules (post for short) are designed to run on systems that were compromised through another vector, whether its social engineering, a guessed password, or an unpatched vulnerability," HD Moore, Rapid7 chief security officer and Metasploit chief architect told InternetNews.com. "This module requires iTunes to be installed and for a backend to be accessible that has not been encrypted."

    If I'm reading this right, the "exploit" is that Metasploit can now read unencrypted backups. I'm not sure how this is an exploit (the backup DB format isn't much of a secret), but there you go.

    If you want a real exploit, look into the "i0n1c" exploit being used to jailbreak phones on the latest OS.

    • Re: (Score:3)

      by joh ( 27088 )

      If you want a real exploit, look into the "i0n1c" exploit being used to jailbreak phones on the latest OS.

      Exactly. It's not that there are no iOS exploits out in the wild. As far as I know there's no remote exploit out there, though. You need physical access to the device or its backup (and then restore from that which requires physical access).

Slashdot Top Deals

Do you suffer painful hallucination? -- Don Juan, cited by Carlos Casteneda

Close