Lifehacker, Emphasis on the ‘Hack’

October 14th, 2009, by The Angry Drunk

It looks like the fuck­ing lack-wits at Lifehacker are still attempt­ing, and mis­er­ably fail­ing, to report on tech­nol­ogy. Case in point: the exe­crable piece of crap that Kevin Purdy shat forth today under the head­line “Latest iPhones Block Jailbreaking.”

Before I address the arti­cle itself I want to make some­thing clear. All of the cur­rent processes used to “jail­break” iPhones (that I know of, cor­rect me if I’m wrong) rely on oper­at­ing sys­tem exploits to do their thing. That’s right kid­dos, exploits as in “the shit that the evil crack­ers use to “pwn” your systems.

So, what heinous crime is Apple has Apple com­mit­ted this time? From the Lifehacker story:

The Dev-Team and other jail­break mak­ers have been using an exploit known as 24kpwn to break into the iPhone and obtain deeper access to install new app mar­kets and unlock cer­tain fea­tures. A new boot­ing firmware update, iBoot-359.3.2, has been shipped on 3GS mod­els man­u­fac­tured since last week, how­ever, and a Dev-Team mem­ber tells the Boy Genius Report that jail­break­ing won’t be pos­si­ble on the newer units, at least until another exploit is found.

OMFGWTFBBQ!!! Apple patched a known exploit in the OS, why those fuck­ing ass­holes!! How dare they make the iPhone more secure at the expense of a bunch of whin­ing fuck – wits?!?

More quot­ing of the ter­mi­nally dumb:

It’s odd to see Apple spend so much effort on fight­ing back against a niche group of iPhone enthu­si­asts, but then again, AT&T has an inter­est in keep­ing things like teth­ert­ing to a min­i­mum. For the time being, if you’re look­ing to break into a newer iPhone model, hold off until another exploit is (inevitably) found.

Look you igno­min­ious piece of squir­rel vomit, Apple isn’t expend­ing effort to block jail­beaking. They’re patch­ing known, exploitable vul­ner­a­bil­i­ties in the oper­at­ing sys­tem. If this was the desk­top Mac OS you twats would be bitch­ing that it took them this long to patch the hole.

In sum­mary, fuck you Kevin Purdy. Fuck you Lifehacker. And fuck you jail­break­ing “com­mu­nity” that would rather see the iPhone remain less secure just so that you can run your crap­tac­u­lar apps.

30 comments - (Comments closed)
«  
  »
  • JDT

    Though I cer­tainly hate tech crap as much as the next guy and I cer­tainly don’t want an inse­cure oper­at­ing sys­tem, I want there to be a jail­break­ing com­mu­nity so that I can jail­break my iPhone. And I will tell you why. My 2 year con­tract with AT&T is over; I got the orig­i­nal iPhone and didn’t upgrade. I just moved to another coun­try where there is no iPhone. How the fuck am I sup­posed to use my iPhone? Mind you, I paid the “sub­sidy” (it’s a loan really) with AT&T (even though since I have the orig­i­nal one I actu­ally paid the $400) and now I don’t have a con­tract with them, which means I should be able to use the phone I paid for any­where I want. But I can’t. Not only that, but like I said, I am in another coun­try now and there is no car­rier here that sup­ports the iPhone. So, what am I sup­posed to do other than jail­break it? What do you think about my sit­u­a­tion? (And please refrain from child­ish com­ments like “move to another coun­try”, “why did you move in the first place?”, “why did you buy an iPhone in the first place?”, or any other shit that does not relate directly with the situation).

  • bkhar­mony

    This is so phe­nom­e­nally stu­pid, I really think it deserved about twice the rant it received. Angry Drunk get­ting lazy?

  • http://twitter.com/jackbrewster Jack Brewster

    So, like, jail­break devs are actu­ally white hats pro­vid­ing secu­rity con­sult­ing to Apple? Thanks, guys!

  • http://www.theangrydrunk.com The Angry Drunk

    First, don’t fuck­ing tell me how I can or can’t respond to you com­ment on my web­site. Second, Apple isn’t under any oblig­a­tion to pro­vide you with a func­tion­ing phone on any net­work other than the one they intended for it to work on. Would you be com­plain­ing if you moved to an area with only CDMA cov­er­age?

    That said, I actu­ally do sup­port the notion that out-of-contract and ETF’d phones (from all man­u­fac­tur­ers) should be eli­gi­ble to be carrier-unlocked. I just think that that should be man­dated at the car­rier level (since they are the one’s that care) and done legit­i­mately, not though hav­ing to hack the phone hard­ware. As for jail­break­ing merely to run unap­proved apps, I don’t care if peo­ple do it, but I do want peo­ple to nut up and call a spade a spade. Jailbreaking uses firmware and oper­at­ing sys­tem exploits to get the job done. It’s tech­no­log­i­cally no dif­fer­ent than a hacker root­ing a desk­top to make it part of a botnet.

  • Stickan

    In Sweden your car­rier can unlock your iphone, my car­rier allows it after 12 month on the con­tract (even if its longer than than that).
    So there is noth­ing inher­ent in the iphone that blocks the car­rier to unlock your phone, so bitch to AT&T for not doing it.

  • http://markdamonhughes.com/ Mark Damon Hughes

    People should be free to car­rier unlock… after they’ve paid their con­tract in full. An iPhone’s unsub­si­dized price is quite high. Asking to buy it at a sub­si­dized price (a huge dis­count) and then take that cheap iPhone to another car­rier is a breach of con­tract, and defraud­ing your orig­i­nal car­rier.

    Everything isn’t free. Pay up or nut up, kids.

  • http://www.facebook.com/people/Matt-Stocum/10505280 Matt Stocum

    I’m pretty sure the exploit they were using was in the boot­loader. My under­stand­ing is that they were essen­tially able to fool it into think­ing it was run­ning signed code when it wasn’t. I think this kind of issue could really only ever be exploited with phys­i­cal access to the phone, in order to load a new OS on to it. So it is a secu­rity issue, but not on the level of some the older ones that exploited a hole in libtiff, and would remotely jail­brake the iPhone just by vis­it­ing a web page. That was a really, really, really nasty hole.

  • http://www.theangrydrunk.com The Angry Drunk

    See, Matt this is exactly the sort of response that con­fuses me. People howl in rage when Apple doesn’t imme­di­ately patch vul­ner­a­bil­i­ties in the desk­top OS that can only be exploited via phys­i­cal access, and rightly so. The very same media out­lets that are exco­ri­at­ing Apple over this were the ones spread­ing all man­ner of FUD over a vul­ner­a­bil­ity that required the receipt of a min­i­mum of 500 per­fectly ordered SMS mes­sages, a hur­dle which, in my book, puts it in the same class as needed phys­i­cal access. An exploit is an exploit, just because this one in par­tic­u­lar hap­pens to enable a behav­ior that you find desir­able doesn’t change that fact.

  • http://www.facebook.com/people/Matt-Stocum/10505280 Matt Stocum

    I’m not try­ing to say it’s not a prob­lem, and that Apple shouldn’t have fixed it. Just that I view a vul­ner­a­bil­ity that requires phys­i­cal access as being way less of an issue than one that can be done over the net­work. At the end of the day, any device that an attacker has phys­i­cal access should be con­sid­ered com­pro­mised. Even with the encryp­tion on the 3GS, from what I under­stand, it’s pretty triv­ial (for a cer­tain def­i­n­i­tion of “triv­ial”) to recover the key with phys­i­cal access, and read data directly off the inter­nal flash.

    I look at this the same way for a desk­top. If Apple had to decide between two secu­rity bugs to fix, one that requires phys­i­cal access to the com­puter, but gets you a root account, and another that can be exploited over the net­work, but only gets access to the cur­rent user’s account. I think Apple should con­cen­trate on the remote exploit first.

  • http://www.facebook.com/people/Matt-Stocum/10505280 Matt Stocum

    What I really don’t get, is that I believe AT&T’s pol­icy with every other phone they have is that 90 days in to the con­tract it can be unlocked. I have a friend who was going to France for a year, and man­aged to talk AT&T into unlock­ing her phone on day 75 or so. I think it helped that she was on her parent’s fam­ily plan, which they were con­tin­u­ing, but AT&T was will­ing to unlock a phone that was still under con­tract. I just don’t under­stand why the iPhone should be any dif­fer­ent. At least let peo­ple do it after their con­tract is expired, or if they buy out their contract.

  • http://www.theangrydrunk.com The Angry Drunk

    To this I agree 100%. Whether it be Apple, AT&T or who­ever, that pol­icy needs to change. And if they aren’t will­ing to change the FCC needs to become involved. Once the car­rier has their pound of flesh the phone should be oper­a­ble on any (com­pat­i­ble) network.

  • http://www.theangrydrunk.com The Angry Drunk

    I agree with you here. Vulnerabilities should be pri­or­i­tized by threat level. What irks me are the peo­ple who are implic­itly argu­ing that Apple should have left this one open because it was use­ful to jailbreakers/unlockers (not say­ing that you’re mak­ing that argu­ment, but some peo­ple are, cf. the dolts at Lifehacker).

  • JDT

    I didn’t tell you how to or not respond on your fuck­ing web­site. I asked politely; there’s a dif­fer­ence. Second, I will tell any­one what­ever the fuck I want wher­ever the fuck I want. If you chose to pub­lish or not is up to you, of course. But my inten­tion was start a more tech­ni­cal dis­cus­sion rather than a child­ish name call­ing one. Third, I didn’t say Apple was under oblig­a­tion to do shit. Fourth, I would not com­plain if I moved to a place with CDMA cov­er­age only because I am not that stu­pid. I agree with the rest of your reply.

  • posixn­inja

    lol, actu­ally this exploit they patched was not a secu­rity threat to any­one, and it didn’t make the phone any more secure then it was before. The only thing that this exploit allowed was to jail­break your phone auto­mat­i­cally when­ever it reboots. It’s totally use­less to any­one unless ANOTHER exploit is there first (the secu­rity threat kind!). Since this isn’t mak­ing the sys­tem any­more secure or stop­ping jail­break­ing, it’s really just an attempt to make jail­break­ers life more dif­fi­cult. Although I’m not really too upset about this for a few rea­sons, A) I knew is was going to hap­pen sooner of later (wish it was later though), B) The jail­break com­mu­nity is a bunch of cry­ing, spoiled snobs who didn’t know how well they had it with this exploit until now, and C) I LOOOVE find­ing new exploits =)

  • Matt

    And the biggest prob­lem with those idiots’ argu­ment is that if Apple gave half a fuck about mak­ing life easy for the jail­break­ers, they could have just let the iPhone run unsigned code from the start. Apple obvi­ously doesn’t want you run­ning any­thing other than their approved soft­ware on the iPhone. If the kids at Lifehacker don’t like it, they can go play some­where else. I must have missed the part in the Bill of Rights where every­one was guar­an­teed an iPhone.

    –Matt (Disqus doesn’t seem to be play­ing nice with me right now)

  • chron­icdev

    Actually, this exploit is in the bootrom. It is no dan­ger for the aver­age user, like if it was an exploit in Safari or some­thing. To get into “bootrom mode”, the user must know exactly what they are doing, they need to boot their device in a spe­cial way with a spe­cial but­ton com­bi­na­tion. This is not some­thing an aver­age user would ran­domly do. Unless you know any­one that would ran­domly decide, “Hey, I’m going to restart my iPhone while hold­ing down the home and power but­tons for 30 sec­onds, and then go on the inter­net and down­load a ran­dom pro­gram that runs a ramdisk that kills my iPhone (no pro­gram like this has been made to date)”, then this arti­cle is noth­ing but a bunch of FUD.

  • posixn­inja

    but I just wanna add, you are absolutely cor­rect, if there is a secu­rity vul­ner­a­bil­ity, they have an oblig­a­tion to patch it up and should. Also none of these users have the right to bitch about, they should of expected apple would patch it up.

    btw, sorry if my grammer/spelling sucks, from one drunk to another ;)

  • not­steve

    “Look you igno­min­ious piece of squir­rel vomit, Apple isn’t expend­ing effort to block jail­beaking.“

    Aren’t they? Is this even exploitable remotely?

    “They’re patch­ing known, exploitable vul­ner­a­bil­i­ties in the oper­at­ing sys­tem. If this was the desk­top Mac OS you twats would be bitch­ing that it took them this long to patch the hole.“

    If it was the only way known to install third-party soft­ware on it, I highly doubt the response would be any dif­fer­ent. The dif­fer­ence is: it’s not. It’s down­right easy to install a whole third-party OS on it, and Apple even sup­ports that, and adver­tises it as a fea­ture (“Boot Camp”). If Apple sup­ported let­ting you run arbi­trary soft­ware on the iPhone, nobody would need a “jail­break” hack.

    As soon as Apple starts sup­port­ing and adver­tis­ing the abil­ity to do what you want with your own iPhone, the num­ber of peo­ple want­ing to “jail­break” their iPhones will drop to approx­i­mately zero.

  • daniel

    One pont most every com­ment on this kind of exploit misses is that this IS a threat if your “adver­sary” has phys­i­cal access to your phone for just a cou­ple min­utes. It could allow them to install all kinds of monitoring/spying software.

  • Hamranhansenhansen

    Sing it, brother!

  • Hamranhansenhansen

    This is the kind of secu­rity ratio­nal­iza­tion they do at Microsoft and which brought us the botnet.

  • Hamranhansenhansen

    > Even with the encryp­tion on the 3GS, from what I under­stand, it’s pretty triv­ial
    > to
    > read data directly off the inter­nal flash.

    My under­stand­ing is the encryp­tion is there only so you can instantly remote wipe the phone by destroy­ing the keys. It is not meant to pre­vent some­one with phys­i­cal access to the device from read­ing data off it if the keys are intact.

  • Hamranhansenhansen

    > The only thing that this exploit allowed was to jail­break your phone

    Prognostication. I don’t know if that’s really enough to make the 99.9% of iPhone users and Apple and the 100 car­ri­ers who are not involved in jail­break­ing feel good about car­ry­ing this bug around in their phone for the con­ve­nience of tin­ker­ers.

    > it’s really just an attempt to make jail­break­ers life more dif­fi­cult.

    Now you are read­ing minds!

  • posixn­inja

    This is only a “threat” for peo­ple who already have their phones jail­bro­ken. That’s all on their own ass. I’d you’re para­noid, then dot jailbreak

  • http://www.theangrydrunk.com The Angry Drunk

    I’m a lit­tle dis­ap­pointed that the Internet Civility Squad hasn’t come ’round yet to chide me on my lan­guage. Come on mother – fuck­ers, I’m on a sched­ule here.

  • posixn­inja

    You took that way out of con­text. This exploit does not allow you to jail­break your phone, it allows your jail­break to stay per­sis­tent, that’s all. The only peo­ple wor­ried are apple and their carriers.

  • Pingback: I Remember When It Used to Be Called ‘Fixing Bugs’ «

  • http://mlowry.myopenid.com/ Michael A. Lowry

    Oh come on. You’re com­par­ing apples to oranges. Not all “exploitable vul­ner­a­bil­i­ties in the oper­at­ing sys­tem” are equiv­a­lent.

    The exploit that the iPhone Dev Team has been using requires phys­i­cal access to the device and requires delib­er­ate action by the user. Even if mal­were existed that took advan­tage of this vul­ner­a­bil­ity, it would still have to be run by the user on his own com­puter, and would require that the user fol­low sev­eral explicit man­ual steps like con­nect­ing his iPhone at the right time and restor­ing the iPhone from the mod­i­fied firmware bun­dle in iTunes.

    This is a far cry from an exploit in that lets some­one halfway around the world take con­trol of your PC from with­out your even know­ing about it.

    An iPhone mod­i­fied with the pwnage tool allows user to run what­ever appli­ca­tions he wants. THIS abil­ity could of course be exploited to, say, trick the user into installing mal­ware on his iPhone. But the user who runs the pwnage tool knows what he’s doing. And it’s not as if the only alter­na­tive to a gen­eral pur­pose hand­held com­put­ing device is one locked down by the man­u­fac­turer. Just imag­ine if you could run only Apple-approve apps on your Mac. Come now! There are other ways to make com­put­ing devices secure.

  • Jack

    Time and time again, crack­ers have shown the abil­ity to find and exploit vul­ner­a­bil­i­ties in unfore­seen ways. It is vir­tu­ally impos­si­ble to pre­dict what they will lever­age and Apple must cover its ass by secur­ing vul­ner­a­bil­i­ties if it hopes to retain cus­tomers and pro­vide a rel­a­tively secure user expe­ri­ence. Appeasing a vocal minor­ity of hack­ers are sim­ply not worth the poten­tial risks.

    Despite the nar­cis­sis­tic para­noia, Apple is not in busi­ness to thwart the enti­tle­tards. It does what is does because it believes those actions will result in profit by cre­at­ing value for its cus­tomers. The iPhone is not the Mac and to try to equate the two is absurd and call­ing their efforts to main­tain the secu­rity and reli­a­bil­ity of their prod­uct dra­con­ian is even more so.

  • Jack

    Time and time again, crack­ers have shown the abil­ity to find and exploit vul­ner­a­bil­i­ties in unfore­seen ways. It is vir­tu­ally impos­si­ble to pre­dict what they will lever­age and Apple must cover its ass by secur­ing vul­ner­a­bil­i­ties if it hopes to retain cus­tomers and pro­vide a rel­a­tively secure user expe­ri­ence. Appeasing a vocal minor­ity of hack­ers are sim­ply not worth the poten­tial risks.

    Despite the nar­cis­sis­tic para­noia, Apple is not in busi­ness to thwart the enti­tle­tards. It does what is does because it believes those actions will result in profit by cre­at­ing value for its cus­tomers. The iPhone is not the Mac and to try to equate the two is absurd and call­ing their efforts to main­tain the secu­rity and reli­a­bil­ity of their prod­uct dra­con­ian is even more so.