@Noobs-R-Us: The worms out there now rely on your password being "alpine" so that it can hack into your phone. If your password's different then it can't get in.
@deanhatescoffee: But that's not exactly the point is it? When you jailbreak and leave the Apple eco system and off the reservation you take your chances that something that looks like a great app could actually be malicious.
It's the same with any electronics hacking, you should only do it if you know what you're doing. Too many people get their portable electronics hacked by outside sources or more tech savvy friends or family. They generally just don't know how to maintain it and as such bear the risk if it all goes pear shaped. Especially those who buy prehacked or pay other people to hack their junk for piracy purposes.
But yeah it's pretty dumb stuff it's why anything I hack, I do myself. I put CFW on my PSP for homebrew and I'll be jailbreaking my iPod Touch when it arrives as well.
Still if we didn't have these people we wouldn't be able to laugh at them when they somehow manage to patch to official firmware and come crying when their pirated games don't work any more.
Don't forget to change the password for 'root' as well as for the 'mobile' user. The 'root' one is how these people are getting in (I think). They are the same by default. Just do a 'su root' from MobileTerminal or an SSH connection. Do the same passwd command.
True enough. If you install Flash on a PC and you get pwned by a Flash vulnerabiltiy -- well, it certainly isn't Microsoft's fault. Same way, it isn't Apple's fault here either.
Classy, Apple. Blame the people trying to get the value they paid for from their phone, and not your power-tripping desire to squeeze every penny out of your customers.
It's no coincidence that Apple went to Verizon first. They're a match made in rent-seeking heaven.
@mullingitover: I could try rewriting lots of code in OS X in an attempt to increase functionality, but I must also accept that in doing so, I'm on my own if anything goes wrong.
If people think the current value of the phone is insufficient as is, why buy it in the first place? Hacking is fine and good to increase your enjoyment of the device, but don't expect to be entitled to support if something goes wrong as a result.
@Kaiser-Machead: I'd be fine with Apple if they had a respectful relationship with the hacking community (they did, after all, come from that community). Of course everyone knows that they're on their own with with a jailbreak, but if Apple weren't just money-grubbing d-bags they'd allow for it, and not play this stupid cat-and-mouse game and then blame the hackers.
@mullingitover: But this begs the question as to whether or not being 'friendlier' towards the hacks would actually make the device more secure. Would the insecurity of the hacking be a result of Apple's constant patching and the hacking community's compensating for said patches, or is it simply a result of a number of these hacks opening particularly vulnerable exploits themselves?
Apple may be money-grubbing douchebags, but being money-grubbing douchebags doesn't force people to open exploits through hacking.
Apple claims that this device is based on a "simplified" version of Mac OS X... Could these iPhone worms be a precursor to more people attempting to hack the full version of Macintosh?
I know that Mac doesn't exactly have SSH enabled by default, but still... This is something worth considering.
@WingedGenius: considering user accounts on os x dont have a default password and this isnt an ssh hole but rather the default password jailbreak software sets for the root account, the answer is... NO.
@Ciber: sad, part is that probably will apple, yet apples lawyers are pretty scary. Most people don't have SSH enabled, Or I wouldn't think they would.
I really agree with apple, on the fact that they did it to themselves, saddly this just makes apple feel more right about jailbreaking.
I know it's not the same, but it's interesting to hear Apple's response when one of their systems with 90% marketshare gets infected with something malicious...
@lostarchitect: Hence the ''I know it's not the same''. He's just pointing out that the market share of iPhones is large and that enough people have created security holes in it, so it only makes sense that black hats will code viruses/worms/malware/etc. for iPhones.
@Nathan Obbards: Hmmm interesting you'd bring up the market share point, since, if I'm not mistaken, the market share of "jailbroken iPhones" must be miniscule compared to that of non-jailbroken iPhones. If the hypothesis "a device with small market share does not attract hackers" is true, then why did they go after jailbroken iPhones?
I actually know the answer. It's because jailbroken iPhones are so much easier to hack than non-jailbroken iPhones. And hackers will hack hackable devices. Something to think about when debating the "security by obscurity" hypothesis for OSX :-)
@Dearhaw: It is market share. Safari, mobile Safari, and OS X are no more secure than Windows. Just look up how quickly they have fallen at Def Con in the past. Market share is why Windows is targeted. Market share and ease of hack are why jailbroken iPhones are being targeted.
@Dearhaw: How many people have Jailbroken phones vs. non jail-broken phones? Can you give me a number? I don't believe we know if it's actually a small amount or a large amount.
Even so, my point was that it was interesting how much Apple slams Windows by mud slinging left and right in their ad spots. They're criticizing Microsoft for having security issues because it's supposedly (and to some degree) their fault. Yet when there's a hole in their own system (even though it's through something not officially supported through them) they tell their users with jailbroken phones they deserve it. It's just interesting to see them take that approach. I'm not criticizing Apple because they shouldn't be held completely responsible for an exploit on their system after something is done to them that isn't supported. But for something they feel so passionately about that they have to skewer other manufacturers, it's just funny to watch them take such a relaxed stance on the matter. Not that we'd expect anything else from them.
As a side note, though, I suppose you could make a stretch to argue that this is very similar to people getting viruses and trojans doing things like illegally downloading music from P2P applications, visiting shady sides, grabbing tons of "free porn" and installing the weather bug/virus.com toolbar for IE--things you also shouldn't do.
@Nathan Obbards: "But the odds were strong that the MacBook would have been the first to fall no matter what Apple did. Why? Glory."
You kinda threw some opinions out there with some pretty weak support. Those articles didn't really indicate that Safari, Mobile Safari, or OSX were any more or less secure.
@natelock: I threw evidence out that showed severe flaws in OS X and mobile OS X. If you choose not to accept that, it's your own fault and ignorance. The fact is that the rewards are greater in general for Windows machines as they control a larger market share, so it is of greater utility for black hats to target Windows machines. They can grow their botnets larger, can datamine, and all other sorts of things, netting a larger cashflow and greater benefits than if they attempted with OS X or Ubuntu. All OSs are unsecure, just the one that provides the greatest utility to black hats is the one that gets hacked the most.
I also love how you selectively read the articles. Here are some key excerpts you apparently glazed over:
''SE researchers Charlie Miller, Jake Honoroff, and Joshua Mason note that there are "serious problems with the design and implementation of security on the iPhone," and they single out the fact that most processes run with administrative privileges.''
''Simply put, security by obscurity isn’t an option for Apple anymore. Why wouldn’t hackers target the MacBook first''
Face it, Macs are not more secure, they are safer because of market share. If you can show me otherwise with evidence, I will acquiesce, but I know you will not be able to find it.
Also note, I am no OS apologist. I am writing this right now from my hackintoshed netbook running Snow Leopard and own a laptop running Vista, waiting for a free weekend to install W7.
@Nathan Obbards: Maybe I jumped the gun a little bit. I skimmed the articles while in class. My argument wasn't that any OS was more or less secure, I just thought it wasn't supported. I am a mac user BUT ultimately I do believe that security is the responsibility of the user, not the OS. I apologize for my itchy trigger finger.
@natelock: It's alright, we all have our moments. It just irks me when people go off on how Safari and OS X are so secure when, in actuality, they are just as secure as any other browser/OS out there. Security really does fall to the user, regardless of what system you are on, just some systems are more susceptible than others due to the rewards of hacking the system.
@Nathan Obbards: You need to learn the difference between a local and remote attack before you start talking about the relative security of MacOS vs. Windows.
@Nathan Obbards: A user web surfing with Safari is not a remote attack. It requires the user to do something (surf to a web page with malicious content, or click on an email with a malicious link in it, etc).
A fully remote attack which compromises MacOS X (ie, gives the attacker root privileges) with no user interaction whatsoever has not been demonstrated by anybody yet.
Several worms affecting Windows which could compromise a machine with no user interaction have happened in the wild over the years (Blaster, Sasser, and others). Simply connecting the machine to the internet (on a public IP, or otherwise exposed to direct connectivity from the Internet, such as using DMZ host port forwarding) would allow it to be compromised even if a user didn't login to the box.
@PurpleMonkeyDishwasher:: Oh thank God. I had to read the whole thread to make sure we talked about this. Because I thought it wasn't not the right structure also, too.
[edit]Well, I think we can just chalk that joke attempt up to a fail. Either way, I do agree and expected more from Apple's response. Or maybe Stevie-boy wrote it, then I'd understand.
11/24/09
11/24/09
11/24/09
#tips
11/24/09
But yeah it's pretty dumb stuff it's why anything I hack, I do myself. I put CFW on my PSP for homebrew and I'll be jailbreaking my iPod Touch when it arrives as well.
Still if we didn't have these people we wouldn't be able to laugh at them when they somehow manage to patch to official firmware and come crying when their pirated games don't work any more.
11/24/09
Apple to jailbreakers:
11/23/09
love, secret, sex, god
Love,
The Plague
11/24/09
11/24/09
11/24/09
11/23/09
11/23/09
11/23/09
11/23/09
11/23/09
11/24/09
11/23/09
Now my car won't stop. :(
To make matters worse, my car company is acting like it's my fault!!!!
11/23/09
11/23/09
also can we get symptoms of this worm?
11/23/09
It's no coincidence that Apple went to Verizon first. They're a match made in rent-seeking heaven.
11/23/09
If people think the current value of the phone is insufficient as is, why buy it in the first place? Hacking is fine and good to increase your enjoyment of the device, but don't expect to be entitled to support if something goes wrong as a result.
11/23/09
I jailbreak my iPhone, but I know that I'm on my own as far as support goes.
11/23/09
11/23/09
Apple may be money-grubbing douchebags, but being money-grubbing douchebags doesn't force people to open exploits through hacking.
11/23/09
I know that Mac doesn't exactly have SSH enabled by default, but still... This is something worth considering.
11/23/09
11/23/09
11/23/09
I really agree with apple, on the fact that they did it to themselves, saddly this just makes apple feel more right about jailbreaking.
11/23/09
11/23/09
11/23/09
11/23/09
11/23/09
11/23/09
I actually know the answer. It's because jailbroken iPhones are so much easier to hack than non-jailbroken iPhones. And hackers will hack hackable devices. Something to think about when debating the "security by obscurity" hypothesis for OSX :-)
11/23/09
[news.cnet.com] [news.cnet.com] [blogs.zdnet.com] [blogs.zdnet.com] [blogs.computerworld.com]
Most have been fixed now, but there are always new ones to find and exploit.
11/23/09
@Dearhaw: How many people have Jailbroken phones vs. non jail-broken phones? Can you give me a number? I don't believe we know if it's actually a small amount or a large amount.
Even so, my point was that it was interesting how much Apple slams Windows by mud slinging left and right in their ad spots. They're criticizing Microsoft for having security issues because it's supposedly (and to some degree) their fault. Yet when there's a hole in their own system (even though it's through something not officially supported through them) they tell their users with jailbroken phones they deserve it. It's just interesting to see them take that approach. I'm not criticizing Apple because they shouldn't be held completely responsible for an exploit on their system after something is done to them that isn't supported. But for something they feel so passionately about that they have to skewer other manufacturers, it's just funny to watch them take such a relaxed stance on the matter. Not that we'd expect anything else from them.
As a side note, though, I suppose you could make a stretch to argue that this is very similar to people getting viruses and trojans doing things like illegally downloading music from P2P applications, visiting shady sides, grabbing tons of "free porn" and installing the weather bug/virus.com toolbar for IE--things you also shouldn't do.
#tips
11/24/09
You kinda threw some opinions out there with some pretty weak support. Those articles didn't really indicate that Safari, Mobile Safari, or OSX were any more or less secure.
11/24/09
I also love how you selectively read the articles. Here are some key excerpts you apparently glazed over:
''SE researchers Charlie Miller, Jake Honoroff, and Joshua Mason note that there are "serious problems with the design and implementation of security on the iPhone," and they single out the fact that most processes run with administrative privileges.''
''Simply put, security by obscurity isn’t an option for Apple anymore. Why wouldn’t hackers target the MacBook first''
Here are a few more articles supporting me, including claims from one of the most prominent Mac hackers:
[www.tomshardware.com] [weblogs.baltimoresun.com] [www.wired.com] [news.techworld.com]
Face it, Macs are not more secure, they are safer because of market share. If you can show me otherwise with evidence, I will acquiesce, but I know you will not be able to find it.
Also note, I am no OS apologist. I am writing this right now from my hackintoshed netbook running Snow Leopard and own a laptop running Vista, waiting for a free weekend to install W7.
11/24/09
11/24/09
11/24/09
11/24/09
11/24/09
A fully remote attack which compromises MacOS X (ie, gives the attacker root privileges) with no user interaction whatsoever has not been demonstrated by anybody yet.
Several worms affecting Windows which could compromise a machine with no user interaction have happened in the wild over the years (Blaster, Sasser, and others). Simply connecting the machine to the internet (on a public IP, or otherwise exposed to direct connectivity from the Internet, such as using DMZ host port forwarding) would allow it to be compromised even if a user didn't login to the box.
Two totally different things.
#tips
11/23/09
11/23/09
11/23/09
11/23/09
11/23/09
11/23/09
11/23/09
11/24/09
[edit]Well, I think we can just chalk that joke attempt up to a fail. Either way, I do agree and expected more from Apple's response. Or maybe Stevie-boy wrote it, then I'd understand.