Kevin, Errant Atheist ([info]atheist_clergy) wrote,
@ 2007-09-26 23:59:00
Previous Entry  Add to memories!  Tell a Friend  Next Entry
iPhone Indicator
Another key step in the iPhone apocalypse was announced today.

When they first announced iPhone, the idea of millions of OSX machines carried everywhere with EDGE, Bluetooth, and WiFi connectivity. I imagined the wonderful world of distributed, mobile botnets, snarfing data and contacts from nearby cell phones and PDAs, and merging all of those data into a spammer's wet dream. Or a distributed surveillance platform, if you buy into the NSA conspiracy theories.

The next indicator that this was going to be "good times," was when they discovered that it was a Unix-like OS, and they had cracked the root and other system passwords (http://www.hackint0sh.org/forum/showthread.php?t=1323)

Today's came from HD Moore announcing his work with Metasploit and the iPhone.
His words: http://blog.metasploit.com/2007/09/root-shell-in-my-pocket-and-maybe-yours.html
Journalist's view: http://searchsecurity.techtarget.com/originalContent/0,289142,sid14_gci1274060,00.html

It's going to be such good times.

So, what are the next steps? Because if I left that out I wouldn't be an intelligence analyst, I'd just be a blogger. According to the mental model, we have the accessibility/vector. What we need are market saturation (some predict 14M sold by end of 2008,) a mesh networking application (or something to cross-connect the myriad of networking options,) and an attractive application to encourage the owners to share amongst each other (say, some funky music sharing application or social-networking tie-in, or instant messaging.) That'll lay the ground work for some very effective malware.

(8 comments) - (Post a new comment)


[info]wxgeek
2007-09-27 08:27 am UTC (link)
and an attractive application to encourage the owners to share amongst each other (say, some funky music sharing application or social-networking tie-in, or instant messaging.)

I swear if I see purple gorillas on iPhones, I'm quitting technology forever.

(Reply to this)


[info]o_carillon
2007-09-27 01:37 pm UTC (link)
Eek. No iPhone for me. However, I'm guessing my current phone is likely susceptible to something similar (though would every app run as root? that seems weird and unlikely-- why did Apple do that?) but I don't think the chocolate will ever be as popular as the iPhone which makes me feel a bit safer. Still, one can change their root passwords-- can't they? Well, not one as in anyone-like-me, but as in anyone-savvy-enough-to-know-how.

(Reply to this) (Thread)

[info]atheist_clergy
2007-09-27 05:48 pm UTC (link)
Other common phon platforms have a higher cost of entry for the attacker. They would have to re-invent a lot of tools and techniques that would work on the different OS. This makes your current phone much less attractive as a target.

(Reply to this) (Parent)

[info]mattcaron
2007-09-27 02:32 pm UTC (link)
Well, but this is not really unexpected.

Being an amateur at this, I've dubbed it the "skynet phenomenon", not talking about AI per se, but in the "an automated user agent uses computers all over teh internets to do naughty things. As such, it is a bitch to kill, because it keeps popping up". Witness what is happening w/ Windows (a clear and present danger to the stability of the internet since 1995!) and the huge zombie/botnet swarms.

Anyway, that was always the unspoken downside to the "everything is an intelligent device which connects to the internet and does shiny things" folks have been promoting. First, security is not a feature, and only comes to bite you after the sale. It's not something marketing can put on an "oh, wow!" sheet. Second, like it or not, security is often antithetical to functionality (you can run a web server, or not. Not running it is always more secure. But, then you have no web server).

Finally, this is worse with "devices" than it is with "computers", because even my grandmother has some type of basic idea of security with computers (even if it's just a "that's okay, I like my photos in albums because when your computer gets a virus and you lose everything, I will still have my photos"). However, a phone is just a phone. It's not a computer. Therefore, the idea of having to apply patches to it is kind of antithetical to the idea of it being a "device".

End rambly bits.

Also, your job sounds vastly more interesting than mine.

I miss real programming. This PHP crap is for monkeys. Firmware was so much more fun.

(Reply to this) (Thread)

[info]atheist_clergy
2007-09-27 05:49 pm UTC (link)
And it's just very hard to stick your iPhone behind a firewall to keep an eye on things. :-)

(Reply to this) (Parent)(Thread)

[info]whod81
2007-10-03 04:13 am UTC (link)
Don't talk down to PHP it has its uses. (ie sutpid web scripting).

I remember when all the hackerkids would get bridge info and then just start all day conference calls. and .... is it a bad thing that I wish just ONCE i'd call into a bridge at my work only to find that hackers had taken it over? I wonder how many people at my company keep things like bridge/passcode #'s in a smartphone that could easily be hacked.... Or things like meetings? I wish a hacker would go to meetings for me, too.

(Reply to this) (Parent)(Thread)

[info]atheist_clergy
2007-10-03 04:27 am UTC (link)
I wonder how many people at my company keep things like bridge/passcode #'s in a smartphone

I wonder how many of them have them published in their Yahoo! or Google Calendar. I know it's more than 0...

(Reply to this) (Parent)

[info]mattcaron
2007-09-27 02:34 pm UTC (link)
Oh, and they'll never hit 14M by the end of 2008 unless they cut the price in half again (which they will likely do, perhaps in Q1 '08).

(Reply to this)

(8 comments) - (Post a new comment)

Create an Account
Forgot your login or password?
Login w/ OpenID
English • Español • Deutsch • Русский…