Apple Warns iOS Users Not to Download PDFs
The PDF vulnerability apparently still lingers in iOS.
Last week Germany's Federal Office for Information Security issued a warning claiming that a security hole in several versions of iOS leaves users vulnerable to malicious code contained in infected PDF files.
The exploit, originally uncovered by a team of hackers at JailbreakMe.com, grants the hacker administration privileges over Apple's devices, giving access to passwords, banking information, email, contact information and even allows for telephone conversation interception... all of which is undetected by the user. So far, the only available patch released to resolve the issue is for jailbroken Apple devices. And so far, there have been no reports of hackers actually taking advantage of this newly-discovered exploit.
"Had this exploit been released by a malicious party, it could have been used to hijack personal information on the device, install malware, surveil the user by tracking their GPS information, access the camera and/or microphone, or a perform a myriad of other nefarious tasks," said iPhone hacker and data forensics analyst Jonathan Zdziarski.
But Apple claims that it's hard at work on a fix. "Apple takes security very seriously, we're aware of this reported issue and developing a fix that will be available to customers in an upcoming software update," the company told The Wall Street Journal in a statement. In the meantime, Apple suggests that users refrain from downloading PDF files until the issues is resolved.
The vulnerability was originally discovered after the latest release of JailbreakMe's software (via a PDF no less) was made available on its website. Downloadable only when visiting the site via an Apple device, v3.0 exploits a vulnerability related to how the iOS version of Safari renders PDF pages. This brought security firm Sophos to full red alert status.
"If visiting the JailbreakMe website with Safari can cause a security vulnerability to run the site's code, just imagine how someone with more nefarious intentions could also abuse the vulnerability to install malicious code on your iPad or iPhone," said Graham Cluley, senior technology consultant at Sophos, in a blog post. "If they exploited the same vulnerability in a copy-cat maneuver, cybercriminals could create booby-trapped Web pages that could--if visited by an unsuspecting iPhone, iPod Touch, or iPad owner--run code on visiting devices."
Gizmodo points out that variants of this browser-based exploit has been around since 2007. In iOS v1.1.1 it appeared as a TIFF rendering exploit and then graduated to a PDF rendering exploit in v2.0 and v4.0. Now the problem reportedly resides in versions 4.3 through 4.3.3, and even includes the new and sparkly iPad 2 tablet.
So far the problem seems to only exist when viewing PDFs within Safari. Currently there are both free and paid apps that can read PDF files although none of them are officially sanctioned by Adobe.
- This DIY Eco-Home Offers Sustainable Living
- AntiSec Releases 90,000 Military Email Logins
- This Project May Turn Human Waste Into Energy
- Google+ May Have Surpassed 10 Million Users
- Opera Developer Ports C++ Game to HTML5
- World's Smallest Space Invaders Arcade System
- Crazy Talk: Windows 8 May Play Xbox 360 Games
- Hybrid SUV Concept Features Slick Design
- ETH Zurich, Microsoft Release New Barrelfish OS
- New DroidDream Light Invades Android Market
- Verizon Eats Into AT&T iPhone 4 Market Share
- Android Browser Now 2nd Most Popular for Mobile
- AT&T Doc Hints iPhone 5 May Arrive October 4
- Nokia Dream Phone Features Triple OS Booting
- Angry Customers Flood Netflix's Twitter, Facebook
- These Solar Cells Can Be Printed Onto Fabric
- LulzSec Returning Soon For One Last Attack
- Microsoft: No Windows Phone 7 Tablets (Still)
- Road Lighting Concept Brings Additional Safety
Thank
you for sharing this technology!!!!!
no one hacks macs/products in bad ways because they believe the mac users have suffered enough.
As iPhone4 users you have to:
1. Hold your iPhone4 in the right way.
2. Live with iTunes handcuffs.
3. Ávoid PDFs.
4....what will come next??
iPhone is really a good product, if I may say so.
So... the hacked phones already have an update that fixes the issue, but Apple doesn't know how to fix it and instead wants it's user to stop supporting Adobe's products? Right.....
As iPhone4 users you have to:1. Hold your iPhone4 in the right way. 2. Live with iTunes handcuffs.3. Ávoid PDFs.4....what will come next??iPhone is really a good product, if I may say so.
/sarcasm?
I would say it is a targetted campaign against Adobe by Apple.
Adobe should retailate by no longer providing Mac supported versions of any of their software, lets see how long the industry continues to use Macs when all the expensive Pro tools used for content generation are PC exclusive.
Apple would back down in good time.
I don't think Apple will ever pix this hole...They'll just wait for someone to get hacked and blame Adobe.
Android fanbois please see: http://www.tomsguide.com/us/DroidD [...] 11830.html
'As iPhone4 users you have to:
1. Hold your iPhone4 in the right way.
2. Live with iTunes handcuffs.
3. Ávoid PDFs.
4....what will come next??
iPhone is really a good product, if I may say so.'
1 - No you don't. I can hold my phone any way I want to and it works fine. Flat out lies wont convince the educated majority, who actually own the phone.
2 - You mean you have to install a program? That is shocking, I must say. I installed iTunes when I first bought my iphone but haven't used it since, perhaps you just haven't got the brains to work out how?
3 - Avoid PDF's - fair enough, the one valid criticism, now (which has affected nobody). Lets compare that to the Android security problem where you couldn't use public internet FULL STOP without sharing all your details with the world.
Bitter, bitter fool :-)
lolz, I have heard since 1989 how apple is pro for design, while of course printing color swatches for pattern generation... on a commodore amiga and thermal color printer. those were the 2ci 2cx designs apple had, which looked like ibm systems, haha. Then it just got more rabid over time. Anytime there was an advance in windows and or the same software released in the windows world, some rabid mac fanboy had to blabber something marketing related. Then I literally had a tech guy I knew there years later tell me Adobe CS1 rotated files on the new macs up to 40x faster than a windows system. so I went back to my P133 with 128mb ram, rotated a file exactly as he mentioned, and it was about 20-25 seconds FASTER than the pro series macs at the school the just bought.
WIN.
enter the world of dual processor pc systems, pii dual 300 supermicro boards, and then the p4,amd series counter parts, overclocking, quad displays etc. everything pc when built was far faster than anything apple could release. ever.
now the true intel mac world, everything can be hackintoshed to do both. why does hackintoshing exist? because there is no real need ever to use a mac for editing video, audio, 3d, or design and nobody but the most foolish super ego issue people are going to drop $3000 for a laptop or desktop that has the same components as a tigerdirect quad core kit at $399.
now that the apple marketshare is hitting harder and expanding, the hackers who rely on large targets like a shotgun spray does are finding it useful to target the iOS and os X. Apple pretends it doesn't happen and secretly has AV in it's OS. lolz. The main problem with Apple is it's marketing hype, the engineers and designers are top notch, parallel honestly to many companies like SONY and DELL. It's almost 99% marketing fluff and for 20 years now the company and it's mactard lemming followers are just cabbage patch doll collectors hoping nobody notices they are wearing the emporer's new clothing.
nothing beats a graphic design company saying "oh well we use macs. we're designers" really? and you drool while reading mostly? Nothing Adobe runs any differently on WIN|MAC at all. Oh look type face conversion, 5 seconds. oh my, a spline. oh wow, a gradient. amazing, actionscript 3 text files, and wow AVI|MOV wrappers ontop of the real compression from various german algorithms. NOTHING is superior about macs, and now they're the target of every nasty hacker group out there.javascript:%20void(0);
I don't think Apple will ever pix this hole...They'll just wait for someone to get hacked and blame Adobe.
The exploited vulnerability is apparently in a open source library called FreeType. It's neither Apple's nor Adobe's code.
I wonder if other systems using FreeType are vulnerable, too.
As iPhone4 users you have to:1. Hold your iPhone4 in the right way. 2. Live with iTunes handcuffs.3. Ávoid PDFs.4....what will come next??iPhone is really a good product, if I may say so.
Oh..
5. You are not allowed to use Adobe Flash
Oh..5. You are not allowed to use Adobe Flash
Epic win comment
This just in... Apple warns iOS users not to turn on their iPhones..
(Sarcasm/rant)What? What is 'Adobe'? Do we need to have that on our system? Tsk-tsk... nooo... to complicated to keep a water'loose' ship floating. Antenna issues? Oh no, software update and it will work.. as long as you are not to far from the towers? Rural? oh my, we are city slickers... why go rural?[actual fact: iPh4 has issues at the edge of towns in Germany... and Australia where other mobiles(cellphones) do not encounter this issue - GSM versions] Oooppsss. You are NOT allowed to change battery. YOU are not allowed to ADD memory. YOU must USE our SOFTWARE aka iTunes (yes, you can use some other software.. but do you think most people know how?). YOU MUST BELEIVE WE INVENTED EVERYTHING [um.. ok i concede style mostly. Now lets see... cellphones existed before iphone? Check. MP3 players existed before iPods? Check. Videoplayers? Check. Touchscreen Tablets? Check. WiFi? Check. Companies wanting SoC to their own specifications? Check. Become a dictatorship? Check. Delete postings about security issues and not acknowledge problems.. umm ok, maybe a check? ;-) Not allaw people to freely distribute what they want but force them to go through checks and validations and if it is liked get approved to be put in a 'closed' appstore? Nope, Apple was first. I am sure there are many other things too. Oh yes, pay for major OS updates? Nope.. Apple first there too. They are service packs, why pay for htem? tsk-tsk. Noticing a pattern? Apples don't catch viruses... shhh they have 'worms' that eat the apple ;-) Steve Jobs going back on his "future visions & promises?" Sure yeah! simple example: licences for the OS-X and clones! He says he wanted them, but then proceeded to get them back with some strong arm tactics too... Don't beleive me? have a search for: "Apple WWDC _97 Steve JobsによるClosing Kynote" (yes, Kynote not keynote hehe). You will see that he "wanted" other people to be making Mac clones.
Can I upgrade to an iPhone and keep my plan? NO!!! you lost me Apple right then and there when you FORCED the Telco's to your own type of plans a few years ago and still do!
[/end sarcasm/rant] Anyway.
Now the one thing they really are good at is aesthetic designs. Hmmm... going to Japan in the early years (after Jobs came back and took control) for their new lines really paid off, same as MS for their XBox series, but then again, they always did make better looking machines in the early years. Now if someone else comes up with a 'sleek' design, straight away they are "copying Apple". Ain't other people allowed to have some flair in design? Just imagine what the fashion industry would be like if only one 'house' was allowed to design 'great looking clothes'.
Ok, back on topic. They can't plug a (w)hole that they have known about for such a long time? Since 2007? "browser-based exploit has been around since 2007"... Safari? Sure looks like it, never know what animal will come at you. Ofcourse, you can use another browser i guess ;-) Oh wait, that would not be very apple-fan boy(girl) like would it? To use another browser on iOS?
p.s. I am just having a go at Apple and their security of which is extremely slack... and other Apple related stuff too...
Epic win comment
Sorry, I forgot about that the flash thing..hihihihihihihi
I don't think Adobe has anything to do with this situation. The article says it's a problem with the way Safari handles PDF files, and I'm willing to bet Safari comes with it's own PDF reader. I mean, if it was an Adobe app handling the PDF, then the Adobe app itself probably wouldn't have the permissions necessary to root your phone (each app should be locked into it's own sandbox). However, because Safari is Apple's own app, it probably has permissions to do whatever it wants on your phone, and a built-in PDF reader could leverage those permissions. Sounds like this is Apple's own problem. Got to love Apple's Malware response: "Don't download malicious apps" has now become "don't download files".
Haha, yet another computer getting hacked. Even when you stupid pc users try to use another operating system, like this "iOS", you get hacked. You pc users and your "viruses" - really makes me feel kind of sorry for you guys who couldnt afford macs. I use a mac so I never have to worry about "operating systems" or "security patches" or viruses.
begone troll! your kind is not welcomed here!
say what?
so pc user can use iOS? mac isn't operating system? and ios is not originated from mac?
and mac is free of virus?
wow >_>
Haha, yet another computer getting hacked. Even when you stupid pc users try to use another operating system, like this "iOS", you get hacked. You pc users and your "viruses" - really makes me feel kind of sorry for you guys who couldnt afford macs. I use a mac so I never have to worry about "operating systems" or "security patches" or viruses.
I guess Apple will get me F***ed too!
The exploited vulnerability is apparently in a open source library called FreeType. It's neither Apple's nor Adobe's code.I wonder if other systems using FreeType are vulnerable, too.
Other systems are also have the vulnerability.
http://www.kb.cert.org/vuls/id/275247
Android fanbois please see: http://www.tomsguide.com/us/DroidD [...] 11830.html
Since it seems that the entire Tom's crew are Android fanbois... LOL - There are no holes in Android, it, in all it's versions 2.2, 2.3 3.0, 3.0.1, 3.1, 3.2, are all totally free of holes... Wow, wait, I why doesn't anyone update their phone to the most recent version? Oh and the Android store has no spam/spyware/fake software...
Please stop throwing stones if you live in a glass house...
WHAT? JUSTIN AND THE OTHER CHUBBY GUY WITH GLASSES CLEARLY TOLD ME MACS AND APPLE PRODUCTS DO NOT GET VIRUSES.
THEY LIED TO ME?!
6. Can't take out the battery*
7. Can't change/remove/replace sd*
*unless you have a hacksaw
Since it seems that the entire Tom's crew are Android fanbois... LOL - There are no holes in Android, it, in all it's versions 2.2, 2.3 3.0, 3.0.1, 3.1, 3.2, are all totally free of holes... Wow, wait, I why doesn't anyone update their phone to the most recent version? Oh and the Android store has no spam/spyware/fake software...Please stop throwing stones if you live in a glass house...
Yes let's compare Apple telling users not to download a major file format, compared to something only a few 1000 people at most downloaded before being removed.
Makes sense! If you go derp a lot that is.
>>>In the meantime, Apple suggests that users refrain from downloading PDF files until the issues is resolved.
No they didnt. they said - avoid opening PDF documents from unknown sources.
Haha, yet another computer getting hacked. Even when you stupid pc users try to use another operating system, like this "iOS", you get hacked. You pc users and your "viruses" - really makes me feel kind of sorry for you guys who couldnt afford macs. I use a mac so I never have to worry about "operating systems" or "security patches" or viruses.
Can you play Crysis?
say what? so pc user can use iOS? mac isn't operating system? and ios is not originated from mac?and mac is free of virus?wow >_>
DNFTT
say what? so pc user can use iOS? mac isn't operating system? and ios is not originated from mac?and mac is free of virus?wow >_>
I guess everyone took that seriously.....
Apple - proving to be the slowest company in patching exploits.