Up to this point, Apple’s iOS devices have remained entirely free of malware, due largely to Apple’s stringent App Store approval process, but a new bug discovered by Mac hacker Charlie Miller could allow hackers to sneak an entire malicious app onto your device without you, or Apple, ever knowing.
Miller plans to showcase the flaw at the Syscan conference in Taiwan next week, reports Forbes, which bypasses Apple’s code signing restriction on iOS devices, allowing someone the chance to run any command they like on your device, rather than only Apple’approved commands and code.
This could enable a developer to publish a seemingly innocent app, and then use the app as a “sleeper cell,” using it to download malicious code to your device, which could allow them to steal photos or contact information, disable or repurpose iOS functions, or use the phone’s other features to do their bidding.
Now you could have a program in the App Store like Angry Birds that can run new code on your phone that Apple never had a chance to check. With this bug, you can’t be assured of anything you download from the App Store behaving nicely.
Miller has created a proof of concept app, called Instastock to show the vulnerability, and the app was submitted and successfully approved by Apple, appearing to show stock tickers, but also communicating with a server in Miller’s house allowing him to remotely execute commands.
While this bug does represent a security problem for Apple, it’s also notable that this is the first such bug that has been discovered for the platform, which Apple is expected to patch quite rapidly.
The below video demonstrates the exploit, in which Miller reads an iPhone’s files and makes the device vibrate using an app which Apple approved.
