What is Digg?242 Comments
- Legolover64, on 11/09/2007, -5/+2131: Go into Apple store.
2: Jailbreak all iPhones/iPod touches
3: Install Ants
4: Walk out knowing you've helped the world - zeromancer, on 11/10/2007, -9/+197wait. you just go to a website and your phone is unlocked? the iphone is CLEARLY running IE5.5
- srslyfkd, on 11/09/2007, -4/+93I'm going to take a moment to explain what's going on in a no-***** manner, so the FUD and other nonsense can cease:
This exploits a bug in Mobile Safari which allows arbitrary code execution -- it's an exploit. While the payload in this case may be "legitimate" insofar as it does what it claims to do, you should be aware that this works by exploiting what is a gaping security hole in Mobile Safari that could - in the hands of the wrong people - do some nasty things to your iPhone.
Because it is a security flaw (likely the same TIFF exploit that people have been using for 1.1.1), and a well-known one at that - you can guarantee that one day in the future Apple will release an update that fixes it, and this page (and the mechanism by which it occurs) will cease to work.
It is worth noting that these kinds of bugs are not new, have existed in one form or another in every single browser you or I are likely to have used (that means Safari, Firefox, and - of course - Internet Explorer). This type of exploit is not new, and is not unique in kind to the iPhone. It does not mean that the iPhone is any less secure than any other device with similar kinds of vulnerabilities, and is not indicative of anything more than the the iPhone is a complex hardware/software combination for which problems other types of hardware/software combinations still exist.
In short: It's a security hole, and not a particularly special one other than having enough people focused on the task of finding it. It's well-known, has appeared on numerous devices and software products, and will be patched. Microsoft fanboys don't get to claim that this proves anything, and Apple fanboys don't get to claim that this isn't the sort of flaw it clearly is.
Good day. - enderiii, on 11/09/2007, -0/+64This jailbreak also patches the vulnerability it uses.
- a3r0, on 10/30/2007, -6/+60Wow, it's a huge bug if code can be executed just from viewing an image.
- DigitAl56K, on 10/30/2007, -7/+54One of these days a site like this is going to secretly dial premium numbers without you knowing after you install it on your phone. It amazes me that people just blindly trust people/websites they know nothing about.
- jmeskimen, on 10/30/2007, -0/+45No profit?
- psyjoniz, on 10/30/2007, -2/+43Breaking : A massive DDoS takes down lolcats.com in a cleverly laid out and executed plan involving iPhones who's owners unwittingly gave full control of their hardware to the malicious attackers, who are still as yet unknown, by simply visiting a website. Bills for the soaring data usage will be collected, says AT&T, stating "whateva, whateva, we do what we waount!". Details at 11.
- redrighthand, on 10/29/2007, -10/+50so easy a caveman could do it..
- sholt, on 10/30/2007, -1/+39I'm more concerned with "go to a webpage and your phone's operating system is permanently modified" but...hey, who needs security in a bowser anyway? We've only been flaming MS for things like this for what? 10 years now?
- enderiii, on 10/30/2007, -0/+35This jailbreak also patches the vulnerability it uses. So jailbreaking your iPhone also secures it. Go figure...
- Firehed, on 10/30/2007, -0/+32Yeah, it is. That's why it's called a tiff "exploit".
- enderiii, on 10/30/2007, -0/+31This jailbreak also patches the vulnerability it uses.
- adroit, on 10/31/2007, -1/+32Best idea ever. Probably better to assemble a team to speed things up and not look suspicious touching every single iphone in the store.
- PathDaemon, on 10/30/2007, -7/+36Mmkay, now I know that there's DEFINITELY a security vulnerability in MobileSafari...
Yeah, guys, don't store any confidential or personal ***** on your iPhones for now. - inactive, on 10/29/2007, -1/+29You mean it took 33 years to get, cost $300 and gave you a V.D.?
- adroit, on 10/30/2007, -2/+29at least this will hold me off until February!
- durrty, on 10/29/2007, -0/+25Please god tell me you aren't referring to Norton anti-virus, we will NEVER need any form of Norton, for anything.
- Dingoboy, on 10/31/2007, -5/+30It works!!!! Thanks so much, I have been regretting ever doing the update. I now have my phone back.
- madmage, on 10/30/2007, -1/+22It's an old Unix term, if the user can't get into the root of the OS, the box was "jailed" a major security concern for corporations were ways to gain root access, or to "jailbreak" the box without opening the box, inside the software.
- taro, on 10/29/2007, -0/+20I can't agree more with this comment:
12. Now that is a real WebApp ;-) Well done guys! - Bootes, on 10/30/2007, -1/+19Uhm I trust tuaw, and I trust the developers that made this site.
- Mono1ith, on 10/29/2007, -0/+18Yeah . . . why would anybody want immediate gratification when they could just wait four months?
- enderiii, on 10/29/2007, -1/+17This jailbreak is legit and confirmed by Nullriver at http://iphone.nullriver.com/beta/
- InitialDMP5, on 10/29/2007, -0/+16I think apple might be blocking that site or doing something. When I walked by the apple store here in SF earlier tonight (around 9:30pm) The whole staff was around all the iPhones doing something. It could be unrelated, but they were closed and that many people are never there at that time of night. Apple has blocked a few sites like myspace from their stores already because people were just using the machines for hours and not getting off.
- brettschulte, on 10/30/2007, -0/+14They're not that fast. We'll hit every store in LA by noon!
- spankaccount, on 10/29/2007, -6/+20What this really says about the iPhone is that it's security is utter crap. I have a lot of respect for the hackers that make third party apps available to us iPhone users - I'm also very, very scared now.
- adroit, on 10/29/2007, -3/+15i think you are just jealous.
- amneosis, on 10/30/2007, -0/+11This is like someone breaking into your house, tidying it up, putting in better furniture then fixing your locks on the way out.
- sholt, on 10/29/2007, -1/+12not only that:
1) Grab corrupted TIFF from site
2) modify it to grab addresses from addressbook and self-replicate
3) e-mail it to your iPhone owning friends
4) ...
5) Profit! - kevinmotel, on 10/29/2007, -0/+10we heard you the first time
- darny, on 10/29/2007, -0/+10self proclaimed noob here. Once i jailbreak my touch:
1. How do I actually install apps?
2. Where should I go to get apps?
3. If things go awry (apple releases a non-complying update, general failure), will restoring factory fix it?
Sorry for the noob questions, but I'd imagine a lot of folks out there have the same questions. - enicholas, on 10/29/2007, -3/+13If having at least one security vulnerability means that your security is "utter crap", then virtually every OS ever released has utter crap security.
- spargett, on 10/29/2007, -1/+10Yeah, but there's no guarantee about what apps you'll be getting in February. Chances are good that Apple won't approve of some, or many of your favorite apps (thanks to early "hackers"). Hopefully we can continue to have our cake and eat it too! Or would it be more appropriate to call it Apple pie?
P.S. Super special thank you to all the guys who worked on this. You deserve every donation you get. - vvaduva, on 10/30/2007, -0/+8It would be VERY handy to note that your third party apps will not work until you install the BSD subsystem package...
- drewfer, on 10/29/2007, -4/+12Tears from my eyes! I've waited so long... Works like sex too!
- ZaNkY, on 10/29/2007, -2/+10For further reading on how this is most probably done check out:
http://blog.metasploit.com/2007/09/root-shell-in-m ...
http://blog.metasploit.com/2007/10/cracking-iphone ...
http://blog.metasploit.com/2007/10/cracking-iphone ...
http://blog.metasploit.com/2007/10/cracking-iphone ...
http://blog.metasploit.com/2007/10/cracking-iphone ... - roessnakhan, on 08/28/2008, -0/+8I instantly want to go to the Apple Store and jailbreak all their display models.
- 0xFEEDFACE, on 10/30/2007, -1/+7Hmm... perhaps Mail.app, Safari.app, etc. should use chroot and drop permissions, eh?
- xkorbin, on 10/29/2007, -2/+8Dugg for the word "assemble"
- inactive, on 10/29/2007, -0/+6Worked great, I got a text in the middle of my first attempt and it ***** it up, I just did a hard reboot (hold home and power buttons) and didn't have to restore, so I went back and tried again and it worked in less than a minute. I would even say less than 30 seconds. I'm browsing installer.app right now so if anyone has any questions feel free to ask me.
Thanks a lot dev team, I'll definitely be donating to encourage you to try even harder the next time Steve screws us over! - spankaccount, on 10/29/2007, -0/+6Dude, trust me. If surfing to a website can completely own your phone, you are in trouble. Apple will close this hole VERY quickly.
- jonoxplor, on 10/29/2007, -2/+7OhFrak, seriously you are really cool trolling on Digg.
- sholt, on 10/29/2007, -2/+7Give me the source to the server so I can inspect it, install it locally, then direct it to my private box to run this. Call me crazy, but I do *not* trust any website that exploits a remote execution bug then asks me to trust it when I have no reason to.
- DeathNoodle, on 10/29/2007, -1/+6Worked perfectly and didn't take long at all.
- yabos, on 10/29/2007, -0/+5Which is exactly the reason Apple wants to make it secure. If you can get something installed by browsing a website, well that's not good at all. The biggest security hole is the iPhone runs as root right now.
- freudianslipper, on 10/29/2007, -1/+6Well, it didn't work for me. Now i'm stuck with the "connect to your computer" screen with no idea how to get back...any help!?
- Ai3d, on 10/29/2007, -0/+5It's dead? I just see the "?" for the tiff and nothing else.
- KloroFormd, on 10/29/2007, -0/+5Yes! It would be awesome to have a completely unresponsive phone in case of an emergency due to lack of memory!
- jarinudom, on 03/31/2008, -1/+6Works great :)
-
Show 51 - 100 of 240 discussions
The Digg Toolbar for Firefox lets you Digg, submit content, and keep track of Digg even when you're not on the Digg site. Download the official 
© Digg Inc. 2009
— Content created and posted by Digg users is