iPhone hacked at Pwn2Own contest
An iPhone got hacked in just 20 seconds at this week's Pwn2Own hacking contest at CanSecWest 2010, reports Ryan Naraine for ZDnet. Hackers Vincenzo Iozzo and Ralf Philipp Weinmann demoed an exploit that allowed them to send a target iPhone to a web site that they'd set up online, and then copied off the entire SMS database on the iPhone (including deleted text messages) to their own server. The browser crashed during the hijack, but the hackers say that with a little tweaking, it would even be possible to nab the information without the user ever knowing that an attack had occurred. Halvar Flake also assisted with the hack, and he said that while Apple does have some protection in place for running malicious code on the iPhone, but it's not enough: "The way they implement code-signing is too lenient." You can see more technical information about the hack over on his blog.
The hackers aren't sharing exactly how they did the exploit -- as specified by the contest rules, knowledge of the hack is becoming property of the contest's sponsor, the Tipping Point Zero Day Initiative, who will pass on a report to Apple and only release details once the hole has been fixed. Safari and Internet Explorer 8 both got owned at the same conference, though details about those hacks are both forthcoming -- Tipping Point was offering up US$100,000 in prizes for exploits on these various programs, and it looks like the prize money has been well-earned.
An iPhone got hacked in just 20 seconds at this week's Pwn2Own hacking contest at CanSecWest 2010, reports Ryan Naraine for ZDnet. Hackers...
Subscribe to Newsletter
Software Updatesmore updates
- Daily App: MyScript Calculator solves your hand-written math equations
- Findery app lets you discover the world around you using annotated notes and maps
- The Learnist app brings its crowd-sourced collection of information to your iPhone
- My cat Cinnamon reviews Friskies Cat Fishing 2
- Photo Grid Collage Maker is capable and free
- iExit gets new features and is now free