iPhone hacks void warranty, Apple says
543451
(InfoWorld) - Less than a week after CEO Steve Jobs said that Apple wouldÂ fight hacksÂ that unlocked the iPhone, the company said any modification, unlocks included, voids the phone's warranty. Saying it had found that many of the unlocking programs "cause irreparable damage to the iPhone's software," Apple spelled out the policy. "Users who make unauthorized modifications to the software on their iPhone violate their iPhone software license agreement and void their warranty," the company said in a statement. "The permanent inability to use an iPhone due to installing software is not covered under the iPhone's warranty." Several unlock hacks are circulating, including the free open-source anySIM unlock created byÂ iPhone Dev Team,Â andÂ iPhoneSIMFree,Â a commercial unlocking program that sells between $45 and $90 online. The unlocks let users insert a SIM card programmed with account data from another mobile provider so the phone can make calls on that carrier's network, rather than solely over AT&T's. Other mods, or modifications, let iPhone owners install their own ring tones -- Apple charges $0.99 on top of the usual $0.99 tune fee for a ring tone -- and add new software to the Apple-approved applications on the device. Apple also said it would issue an iPhone update this week, and hinted -- as expected -- that it will use firmware updates toÂ cripple unauthorized modifications.Â "Apple has discovered that many of the unauthorized iPhone unlocking programs ... will likely result in the modified iPhone becoming permanently inoperable when a future Apple-supplied iPhone software update is installed," the statement said. The coming update has been no secret. Shortly after Jobs unveiled the new iPod line and announced the $200Â iPhone price dropÂ that angered many early buyers, Apple confirmed that it would update the device to add new features, including the ability to buy tracks from the iTunes music store over Wi-Fi. Not surprisingly, Apple's policy didn't scare off those who have modified their iPhones. On the company's iPhone support forum, a user identified as ansuz07 said, "The percentage of iPhones that have become bricked from hacks is very low. Even those that experienced problems could be fixed by a simple restore. Apple is going to make it sound a lot worse than it actually is since they are the ones who don't want you to do it in the first place." ComputerworldÂ is an InfoWorld affiliate. Â
320036
(InfoWorld) - Three security researchers claimed Sunday that they have found the first exploitable vulnerability in Apple's iPhone, a flaw that allows them to steal any data from the device or even to turn it into a remote surveillance tool. The trio -- Charles Miller, formerly with the National Security Agency; Jake Honoroff; and Joshua Mason of Baltimore-based Independent Security Evaluators (ISE) -- have notified Apple of the vulnerability and given the company less than two weeks to fix the bug before Miller presents more information at the Black Hat conference on Aug. 2. According to a paper posted by the three, they rooted out a vulnerability in the iPhone's version of Safari using "fuzzing" tools and wrote a proof-of-concept exploit that can be delivered from a malicious Web site or using "man in the middle" tactics to trick users into connecting to a malicious wireless access point. Once the exploit runs, it's essentially game over, the researchers said: The iPhone is owned. "In our proof of concept, this code reads the log of SMS messages, the address book, the call history, and the voicemail data," the researchers wrote on the ISE site. "It then transmits all this information to the attacker." But wait -- there's more! That, however, could be just the beginning. The researchers claimed that a second exploit actually operated the iPhone remotely once the device was hijacked. "When we viewed a second HTML page in our iPhone, it ran the second exploit payload which forced [the iPhone] to make a system sound and vibrate for a second," they said in the paper. "Alternately, by using other API functions we discovered, the exploit could have dialed phone numbers, sent text messages, or recorded audio (as a bugging device) and transmitted it over the network for later collection by a malicious party." The vulnerability was reported to Apple last Tuesday, July 17. "We proposed a fix Apple could include in a future iPhone update," the researchers said, "but we don't know if they plan to do so. They responded and are looking into it." In an e-mail late Sunday night, Apple spokeswoman Lynn Fox would only say: "Apple takes security very seriously and has a great track record of addressing potential vulnerabilities before they can affect users. We're looking into the report submitted by I.S.E. and always welcome feedback on how to improve our security." She declined to answer questions about the Aug. 2 deadline, whether Apple would issue a patch before then, or what the company thought of the way the trio disclosed the vulnerability. Miller will provide more information on the vulnerability and exploit at the upcoming Black Hat 2007 security conference, which opens next Saturday, July 28, in Las Vegas. But is this the ethical way? ISE's president, Avi Rubin, defended the decision to announce the existence of the vulnerability prior to a patch being made available by Apple. "Why are we doing that? Well, I believe that there is a social responsibility to report it when a device is vulnerable to attackers," said Rubin on his own blog Sunday. "People buy these things and use them in ways that put their identity and their online accounts at risk, and by exposing these vulnerabilities, we can make users better judges of how to use their high-tech devices." Rubin is familiar to many security observers from his research into problems with electronic voting systems. The paper by Miller, Honoroff, and Mason also spelled out a number of weaknesses in the iPhone's security architecture, although it didn't specifically pin the vulnerability on any of those flaws. One, however, most likely contributed to the reach of the exploit. "There are serious problems with the design and implementation of security on the iPhone," the paper said. "The most glaring is that all processes of interest run with administrative privileges. This implies that a compromise of any application gives an attacker full access to the device." Other deficiencies the trio cited in the iPhone's operating system included not using address randomization -- a technique applied by Windows Vista that's designed to make it tougher for hackers to write reliable attack code -- and allowing code in the heap to execute. Those last two shortcomings have been criticized in the desktop version of Mac OS X for some time. Three months ago, during the fallout after a hacking contest that jacked a MacBook Pro notebook, HD Moore -- the vulnerability researcher noted for the Metasploit hacking and attack testing software -- took on the claim that Mac OS X is safer than Windows. "The Mac OS X platform is years behind Linux, Windows, and OpenBSD in terms of operating-system security," said Moore then. "All of the above platforms support some form of address randomization (ASLR) and include features that make exploitation slightly more difficult." The ISE researchers have also posted a short video of their hack in action on YouTube.
275415
Blog: The hack allows Wi-Fi and iPod features but won't allow you to make phone calls.
148438
Look, ma, no PC/Mac iPhone hackers have released a tool that allows owners of firmware 1.1.1 iPhones and iPod Touches to open up their devices to third-party apps - all without the need for a host Mac or PC.â¦
702695
SAN JOSE, Calif., Sept. 24  â Apple warned on Monday that iPhone owners who have used unauthorized programs to unlock the cellular service feature of their handsets may end up with a phone that does not work after the companyâs next software update.
415277
(InfoWorld) - One of the groups that claims it has developed an unlock hack for Apple's iPhone is now saying it will only offer the software to resellers, not to individuals, a popular technology blog reported Monday. According to an e-mail message sent to interested volume sellers -- and posted by Engadget Monday -- iPhoneSIMFree said it would not sell the unlock directly to iPhone owners. "iphonesimfree.com is a wholesale only company," read the e-mail. "Although we could, we do not and will not sell directly to end-users because we want to work together with our valuable resellers as a team and not interfere in their business." Late last month, iPhoneSIMFree said it had created software that would let iPhone owners make calls on mobile networks other than AT&T, the smart phone's official and exclusive carrier in the U.S. Unlocking the iPhone is contrary to Apple's intent; according to the company, iPhones must be activated only with AT&T, and buyers must subscribe to a two-year AT&T calling plan. Even so, Apple has made no public announcement about iPhoneSIMFree or any other of several unlocking schemes that have been publicized. iPhoneSIMFree's e-mail also outlined the unlock process and spelled out its pricing structure. The unlock requires that a file be installed on the iPhone and a connection made to the iPhoneSIMFree servers; the latter, said iPhoneSIMFree, links the specific iPhone to the unlock. Resellers will handle part of the process. Prices will range from $25 per unlock (in lots of 5,000 or more) to $36 (in lots of 50). The company, which has no mailing address, has kept its composition and the identity of its developers, under wraps. Its Web site, for example, uses an anonymity service to cloak the usual address, phone number, and contact person information searchable via WHOIS. iPhoneSIMFree also said it would not guarantee that the unlock would work in the future. "It does currently work on all firmware versions, up to and including, 1.02," said iPhoneSIMFree in the e-mail quoted by Engadget. "We will naturally try to provide our resellers an updated version of our software for each firmware update, it is in our interest, but we do NOT guarantee that we will be able to do so." Apple's iPhone updates have required users who installed hacks or work-arounds to restore their devices from scratch, which erased the modifications. The most recent update, 1.0.2, however, did not cripple most hacks as had the first firmware update. An Irish company that announced another unlock has been silent on the subject for a week. UniquePhones last mentioned its iPhone unlock on Aug. 28 when it posted video of an unlock in progress. Prior to that, UniquePhones had said it would start selling its unlock Aug. 25 but backed off after receiving a phone call it said came from a California law firm representing AT&T. Another unlock, a Czech product dubbed TurboSIM, is currently unavailable; its maker's Web ordering site had been inundated, and now sports messages such as "Sorry, temporarily closed" beside the unlock product. Computerworld is an InfoWorld affiliate
165165
Blog: With patience wearing thin because of iPhone's bugs, I consider restoring the iPhone's settings.
723599
A hacker group has released a free, open-source unlock for Apple Inc.'s iPhone, although it's not for the faint of heart.
708616
Efforts by the hacker community to get to the heart of the iPhone continue. A push last week to modify the gadget's bootloader was stymied by effective use of an RSA private key, and attention has now turned to a promising assembler-utility strategy.
753754
(InfoWorld) - Users are reporting that a new update to Apple's iPhone is making previously unlocked iPhones unusable. The iPhone 1.1.1 update , released Thursday, breaks phones that have been hacked so that they work with providers other than AT&T, the only U.S. provider Apple has allowed to carry its mobile phones. In recent months, a number of software tools have been developed whichÂ allow iPhone users to break free of Apple's AT&T-only restriction, but Apple has said that it would fight any attempts to unlock the iPhone. Earlier this week the company released a warning that unlocked iPhones "will likely result in the modified iPhone becoming permanently inoperable when a future Apple-supplied iPhone software update is installed." Shortly after the Thursday update was released, users of unlocked iPhones began reporting problems. Security researcher Tom Ferris said the new software disabled a phone that had been unlocked using the open-source anySIM software in order to work on T-Mobile's wireless network. After the update, the iPhone was stuck with an error message and apparently unusable. "It kept saying 'unsupported SIM card,' even with the AT&T SIM card in it," he said. "You can turn the phone off or on, but we just can't figure out how to get past this 'SIM card not supported'," he said. SIM cards contain account information and are used to authenticate devices on certain types of mobile networks. Unlocked iPhones can use SIM cards from non-AT&T networks. Others were reporting similar problems on Thursday. The update also appears to disable the 'Jailbreak' hack which allows users to install unsupported software on the iPhone, Ferris said. After the 1.1.1 patch was installed, it wiped out all of the third-party applications he had installed on a second iPhone, he said. The new software is Apple's biggest iPhone update to date, andÂ it fixes a number of security flaws in the iPhone's browser, mail client, and Bluetooth networking server. The majority of the flaws do not appear to be critical, but the update fixes a larger number of bugs than the first iPhone update, released July 31. Hackers have said that the iPhone's browser and mail clients are the most likely sources of software flaws and this release bears that out. Apple fixed seven flaws in the Safari browser, two in the iPhone's mail client, and one Bluetooth bug with the release. The Bluetooth flaw could be the most serious -- Apple said that it could allow an attacker to run unauthorized code on the iPhone -- but because Bluetooth works over a range of just a few feet, the attacker would have to be standing near the victim for any exploit to work, said Andrew Storms, director of security operations with nCircle Network Security. Noted hacker HD Moore agreed that the Bluetooth flaw was serious. "The only bad issue here is the Bluetooth [flaw]," he said. "I will start working on this tonight." Though there may be some technical limitations to what an attacker could do by exploiting this bug, it "could be a nasty remote exploit," he added. Earlier this week,Â Moore added iPhone hacking capabilities to the Metasploit hacking toolÂ that he develops. The patch also fixes some cross-site scripting and JavaScript flaws in the browser that could also be serious, Storms said. These flaws could be exploited to make the browser run unauthorized JavaScript code, he said. Mobile phone users typically cannot update their own software, but Apple introduced this capability in the iPhone, which uses the update mechanism in the phone's iTunes music player. iTunes checks for these updates once per week, so it may take up to seven days for all iPhone users to see these updates. Apple advises users to install the update immediately.
412363
Despite earlier rumors to the contrary, legal experts say Apple's threat to void the warranty on unlocked iPhones is probably standing on firm legal ground.
455250
A bug in Apple Inc.'s popular iTunes music player and online store software could be used by hackers to run malicious code on a compromised PC or Mac.
379550
Hackers have found a way to use Apple Inc's iPhone on networks other than AT&T Inc's, opening up the coveted device to rival carriers and overseas customers, according to a Web report on Friday.
647744
With iPhone prices dropping and noticeable improvements in the quality of iPhone hacking tools, Apple's phone has become a more interesting target for hackers.
58983
Hackers claim 'very significant progress' toward making Apple's iPhone work with carriers other than AT&T.
694942
SAN FRANCISCO - Apple Inc. said that almost one out of every six iPhones sold may have been unlocked to run on unauthorized wireless networks, surprising analysts who had estimated the problem wasn't as widespread.
390638
A team of computer security consultants say they have found a flaw in Apple's popular new iPhone that allows them to take control of the device.