According to Charlie Miller, an analyst at the Independent Security Evaluators (ISE) firm, "For three months, I was walking around with a vulnerable iPhone. [Apple] had the vulnerability and the exploit, they understood the exploit because they patched it on Mac OS X, but then they said the didn't know that [the iPhone] was vulnerable."This is the same vulnerability Miller used to gain control of a Mac OS X system at the CanSecWest security conference and win a $10,000 prize package. It took Apple 3 weeks to patch Safari on OS X, much longer to patch the iPhone.
Miller reports "So Apple said 'We ran the exploit and it ran out of memory and it didn't do anything bad.'" What Apple had apparently not done, he added, was to run the actual exploit line. "Obviously," he said, "they didn't do a very good job of testing. They had the source code, and they thought that the iPhone wasn't vulnerable."
The article says the incident made Miller question whether Apple can effectively manage security on its multiple platforms. "I don't think they do a very good job of that," he said. "They hadn't patched the iPhone since February. For more than four months, it's had vulnerabilities that were patched in Mac OS X."
Leave a comment