iPhone vulnerability is also there in Mac OsX and Windows version Safari - Hackers Say
The iPhone vulnerability that could let hackers steal data or commandeer the device also exists in the desktop edition of Apple Inc.’s Mac OS X operating system, the exploit’s researchers said today.
Charles Miller, one of the three researchers from Baltimore-based Independent Security Evaluators (ISE) who found the bug and wrote proof-of-concept exploits, confirmed that the vulnerability in the iPhone version of Safari is also present in the desktop version of the browser. Safari is included with all Mac OS X installations.
The Windows version of Safari is also vulnerable. “[But] it may or may not be exploitable there,” Miller said.
Miller, Jake Honoroff and Joshua Mason found the Safari flaw using what Miller described as “fuzzing” techniques. Fuzzing, a tactic commonly used by vulnerability researchers, drops random data into applications or operating system components to see if — and where — breakdowns occur. Typically, the process is automated with a fuzzer, software that hammers on application inputs.
Not that the iPhone made it easy. The lack of debugger, for example, required that Miller and the others turn to alternatives, including the Mac OS X crash reporter, which logs all crashes, for ways to probe the iPhone. “The crash reports contained the contents of registers and what libraries were loaded,” giving the team some clues, Miller said. Others they gleaned by examining the phone’s core applications, which they could pull off the device only using iPhoneInterface. That program, part of the results of a group effort at the iPhone Dev Wiki, lets researchers and hackers modify the phone.
“Between the crash reports and the core files, we had a good picture of the application when it crashed,” said Miller. “We found a few crashes that stuck out from the rest.”