full-disclosure - iUsability Pwned - aka. - Apple iphone automatically connects karmetasploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 7 Jul 2009 10:35:09 +0200
From: Max Moser <max.moser@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: iUsability Pwned - aka. - Apple iphone
	automatically connects karmetasploit

Hi there, just in case you didn't see the post at my blog
http://remote-exploit.blogspot.com/ here is a small summit of the
problem:

The iPhone running OS 3 has a stupid usability feature. It seems like
the iPhone is automatically opening a browser when joining a network.

When joining a network, the iPhone tries to do the following:

1. DNS queries for www.apple.com
2. Opening http://www.apple.com/library/test/success.html

When both are successful, then fine... the phone gets back "success"
and everything is ok.
When both are failing... that's fine as well because then the phone
assumes that the Internet connection is not up and running.

If the phone can successfully query the name but get back any
different content than "Success"
it assumes that there is a captive portal which requires you to
authenticate first to get access to the Internet. (Hotels, Hotspots
etc)

It seems like Apple was thinking.. damn that's annoying for the
user... lets open up
Safari automatically if this special case comes into place :-)

Usability kills security .... together with karmetasploit its a very
evil thing. Get IPhone cookies, accounts and maybe even
system control... depending on the bugs you have left to test.

You can see the whole thing as a video @ vimeo
http://www.vimeo.com/5466236 .... now lets find some new safari bugs
:-)

Greetings

Max

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/