Posted by: David Harley | June 4, 2013

iPhone code injection free of charge

At least, Billy Lau, Yeongjin Jang, and Chengyu Song, all from Georgia Tech, are presenting at Blackhat (27th July-1st August) on how they built a ‘Proof of Concept malicious charger’ in order to make use of the iPhone’s ability to recharge and transfer data through the same USB connection. This feature (and it is a feature, not a bug), has previously been used for jailbreaking, but the presentation summary claims that they were able to bypass iOS defence mechanisms to inject software into current iGadgets running the latest iOS versions, without jailbreaking or user interaction. (But don’t panic – the breach does require a malicious charger!)

The presentation is said to describe iOS defence mechanisms and illustrate how injected software can be made persistent, as well as suggesting remediation measures. Here’s one: don’t use any chargers you find lying around at Blackhat.

Story also covered here, and here, and here.

David Harley
Small Blue-Green World
ESET Senior Research Fellow

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

Categories

%d bloggers like this: