Penetration Test Report (IndependentSecurityEvaluators): ISE   Apple iPhone

Security Evaluation of Apple’s iPhone
Charlie Miller
Jake Honoroff
Joshua Mason
Independent Security Evaluators
{cmiller, jake, josh} AT securityevaluators.com
July 19, 2007
Executive Summary
The Apple iPhone was released to much fanfare on June 29, 2007. Because of the large
amount of personal information stored on these mobile devices, we decided to conduct a secu-
rity analysis of the iPhone. The iPhone's applications for surfing the web and checking emails
are potentially at risk to remote attacks. We wanted to determine exactly how well the software
on the iPhone was designed to resist such attacks.
The iPhone runs a stripped down and customized version of Mac OS X on an ARM processor.
Much of the device's claimed security is reliant on its restrictions against running third party ap-
plications. Only Javascipt code can be executed in the Safari web browser, ensuring that all
such code executes in a “sandbox” environment. Many of the features of Safari have also been
removed, such as the ability to use plug-ins such as Flash. Likewise, many filetypes cannot be
downloaded. These actions serve to reduce the attack surface of the device.
However, there are serious problems with the design and implementation of security on the
iPhone. The most glaring is that all processes of interest run with administrative privileges. This
implies that a compromise of any application gives an attacker full access to the device. Like the
desktop versions of Mac OS X on which its operating system is based, the iPhone also does not
utilize widely accepted practices, such as using address randomization or non-executable
heaps, to make exploitation more difficult. These weaknesses allow for the easy development of
stable exploit code once a vulnerability is discovered.
To demonstrate these security weaknesses, we created an exploit for the Safari browser on the
iPhone. We used an unmodified iPhone to surf to a malicious HTML document that we created.
When this page was viewed, the payload of the exploit forced the iPhone to make an outbound
connection to a server we controlled. The compromised iPhone then sent personal data includ-
ing SMS text messages, contact information, call history, and voice mail information over this
connection. All of this data was collected automatically and surreptitiously. After examination of
the filesystem, it is clear that other personal data such as passwords, emails, and browsing his-
tory could be obtained from the device. We only retrieved some of the personal data but could
just as easily have retrieved any information off the device.
Additionally, we wrote a second exploit that performs physical actions on the phone. When we
viewed a second HTML page in our iPhone, it ran the second exploit payload which forced it to
make a system sound and vibrate the phone for a second. Alternatively, by using other API func-
tions we discovered, the exploit could have dialed phone numbers, sent text messages, or re-
corded audio (as a bugging device) and transmitted it over the network for later collection by a
malicious party.
Apple was notified of these findings, including detailed technical documentation, on July 17th.
While this paper serves to highlight our findings, we will not release the remaining technical de-
tails until August 2nd. This delay is provided in order to give Apple sufficient time to produce
patches so that attackers cannot take advantage of these vulnerabilities.
Introduction terface. This tool, using the same API func-
tions used by the iTunes player, was able to
After months of anticipation, the iPhone was
access the small portion of the filesystem ac-
finally released to long lines of customers on
cessible to iTunes. The user of this program
June 29, 2007. Touted by some articles as
could navigate through the file system and
the most “successful product introduction of
retrieve and place files on the device. The
the 21st century”, we felt it was important to
next step was a program developed called
examine this device for its overall security
jailbreak. This program modified the iPhone
posture.
in such a way that the entire filesystem could
be accessed through the iPhoneInterface ap-
Mobile devices, such as the iPhone, are be-
plication. This did have the drawback that
coming ubiquitous in society. Individuals talk
syncing was impossible after using the tool.
to their friends, conduct business, shop on-
One of the latest developments includes the
line, and listen to music, all from these small
ability to activate the phone by only using
portable computers. Some of these devices,
AT&T prepaid cards. Only in the last couple
including the iPhone, provide data transmis-
of days did this group of researchers develop
sion over cellular communications and also
the ability to produce binaries for the iPhone.
through WiFi connections when accessible.
At the writing of this document, no one has
These mobile devices are often used in cor-
been able to unlock the phone.
porate settings and travel in and out of the
physical building, passing from outside the
Overall Security Architec-
firewall into the heart of the protected net-
work of enterprises. People store their ad- ture
dress books, passwords, email, and other
personal data on these devices. For these
The Apple iPhone runs a stripped down ver-
reasons, it is important that these devices are
sion of the Mac OS X operating system
designed and implemented in as secure a
commonly found on Apple desktops and
manner as possible.
servers. The major difference is that it runs
on an ARM processor instead of x86 or Pow-
In this paper, we examine the security of the
erPC processor. ARM processors are com-
Apple iPhone. We highlight some strengths
mon in mobile devices due to their lower
in the design and point out some significant
power consumption. The iPhone comes with
problems. We demonstrate the security defi-
a version of the Safari web browser called
ciencies by producing an exploit which takes
MobileSafari. This version of the browser is
advantage of a flaw in the MobileSafari appli-
very similar to the typical Safari application
cation to gain complete control over the de-
and they share much of the same code base.
vice.
However, many of the features of Safari have
been removed in MobileSafari. Likewise,
Public Developments
MobileMail is the iPhone mail client and is a
Prior to this work, there was a large amount stripped down version of the Mail program
of work by independent researchers in an found on Mac OS X. There are also pro-
effort to access and unlock the iPhone. grams to send SMS text messages, view
Much of this work was reported on the YouTube videos, and check stocks, among
#iphone-dev IRC channel. One of the first others. The iPhone is capable of sending
discoveries was made by a noted researcher and collecting data using the EDGE network
Jon Lech Johansen, known as “DVD Jon”. provided by AT&T wireless. Alternatively, it
He figured out a way to access the WiFi ca- can send data via WiFi connections and also
pabilities of the iPhone without activating it. has Bluetooth capabilities. An iPhone is acti-
Next, a tool was developed called iPhoneIn- vating by communicating with the iTunes
program running on a computer over a USB as discussed in the previous section). By not
connection. This USB connection is also the allowing 3rd party applications, again the
way the iPhone retrieves and syncs data number of opportunities for attackers is di-
from desktop computers, allowing syncing minished.
with Calendars, address books, mail settings,
etc. It also is the mechanism whereby music Unfortunately, once an iPhone application is
and videos can be placed on the iPhone. breached by an attacker, very little prevents
an attacker from obtaining complete control
The security architecture of the iPhone can of the system. All the processes which han-
best be described as one of reducing the at- dle network data run with the effective user id
tack surface. This is accomplished by