Jailbreakme Takes Advantage of 0-day PDF Vuln in Apple iOS Devices
Three days ago a new version (v3) of Jailbreakme (aka jbme3.0), the website used to jailbreak Applie iOS devices (such as iPhone, iPod Touch and iPad), was released. The site takes advantage of userland-based exploits to take full control of these devices by simply visiting a web page. This v3 version makes use of a 0-day PDF vulnerability on a first stage, and a iOS kernel vulnerability to elevate privileges on a second stage.
These vulnerabilities affects multiple Apple devices and versions, up to iPad2 and iOS 4.3.3.
As far as we know, Apple has not released an official update yet against these vulnerabilities (although it's working on it), so all devices are at risk. If you have a jailbroken device, it is recommended to install “PDF Patcher 2” from Cydia to eliminate this risk (any firmware version). More details on the Dev Team blog: http://blog.iphone-dev.org.
The common but not very realistic recommendation applies: do not open "malicious" PDF files or visit untrusted websites (using Mobile Safari)! I always wonder how end users can determine if a PDF or web page is malicious before opening it... probably those that contain the word malicious on its name or domain name :)
----
Raul Siles
Founder and Senior Security Analyst with Taddong
www.taddong.com
Security Testing SSL/TLS (HTTPS) Implementations
During the last few months we have talked about improvements on your SSL/TLS (HTTPS) implementation, for example through the usage of newly supported HTTP headers, such as Strict-Transport-Security (available since Firefox 4). Besides that, and due to the fact there have been several serious CA incidents, the general public has been more aware of the weaknesses of the current Internet PKI the digital commerce is based on.
Leaving apart the current Internet PKI and weak trust CA model, I want to mention a tool we released a few weeks back called TLSSLed. Today, version 1.1 has been released. Its goal is helping organizations to test their SSL/TLS (HTTPS) implementation for common flaws and misconfigurations on web servers / applications.
The current (version 1.1) tests include verifications to check if the target website supports the SSLv2 protocol, the NULL cipher, weak ciphers based on their key length (40 or 56 bits), the availability of strong ciphers (like AES), if the digital certificate is MD5 signed, if secure SSL/TLS renegotiation capabilities are available, details about the certificate public key length, the certificate subject and issuer (CA), as well as the validity period, plus tests for the existence of HTTP secure headers, such as Strict-Transport-Security and cookies with and without the "secure" flag set.
The tool can be downloaded from Taddong's labs page.
The tool is just a Linux shell script, so I encourage you to inspect it, and contribute improvements and new tests (you can simple send me an e-mail or add comments below). Future versions will incorporate them.
Time to improve your web sever / application SSL/TLS (HTTPS) implementation!
----
Raul Siles
Founder and Senior Security Analyst with Taddong
www.taddong.com
Comments