A website that has made it simple for iPhone
and iPad users to jailbreak their devices is not just a nuisance for Apple, who
want to discourage owners from jailbreaking their devices, but is also a
portent for future malicious attacks.
Owners of Apple gadgets, including the
recently launched iPad 2, are presented with an easy way to jailbreak them,
opening up the possibility of installing apps that have not been approved by
the official Apple AppStore.
Normally, jailbreaking requires users to
connect their device to a computer before they can start to tamper with the
set-up of their iPhone or iPad and gain access to the Cydia underground app
store.
The drive-by jailbreak is possible because
the website exploits a vulnerability in the way that the mobile edition of
Safari (the default browser used in the iOS operating system) handles PDF files.
Because Apple has not yet patched this latest
vulnerability, iPad and iPhone users could be at risk from hackers if they
chose to exploit the same vulnerability to install malicious code.
“Cybercriminals would be able to create
booby-trapped webpages that could – if visited by an unsuspecting iPhone, iPod Touch
or iPad owner – run code on visiting devices without the user’s
permission,” said Graham Cluley, senior technology consultant at Sophos.
“Apple will be furious that this vulnerability has been made public in
this way, and that they have not yet got a patch to protect their millions of
users.”
Sophos’s experts have added detection of the
exploit code as Exp/PdfEx-ER, but as Apple does not allow anti-virus software
to be listed in the official iPhone AppStore there is no on-device protection available
for users.
“A website like JailBreakMe is making it
easy to jailbreak your iPhone or iPad – but it could also be said to be giving
a blueprint to malicious hackers on how to infect devices with malware,”
continues Cluley. “There are many cybercriminals who would love to infect
iPhones and iPads, and eyes will now be turning towards Apple to see how
quickly they can issue a patch for iOS to close this vulnerability.”
By TelecomLead.com Team
[email protected]
