Mar 11, 2011 10:53 GMT  ·  By

Apple-nemesis Charlie Miller says that iOS 4.3 still poses some of the security vulnerabilities he was able to exploit during a hacking contest recently, though people attempting to reproduce the hack will likely not succeed, he revealed in an interview.

A researcher with the consulting firm Independent Security Evaluators, Miller is at his fourth successful attempt to compromise an Apple device using his wits, this time stealing an iPhone’s address book contacts via a Safari flaw.

The mobile version of Apple’s web browser was apparently no match for Miller’s exploit, which he prepared a day in advance to deploy on the handset as the gun went off at Pwn2Own 2011 day 2.

In an interview with ZDnet, Miller revealed that his hack simply involved pointing mobile Safari on an iOS 4.2.1 iPhone 4 to a rigged website.

The drive-by exploit initially crashed the browser, but Miller was ultimately able to hijack the phone’s entire address book on his second attempt.

He told interviewers that, although his exploit works as advertised on iOS 4.2.1 handsets, the same hack cannot be pulled off on devices running the newer iOS 4.3.

Not that the flaw isn’t there still, but Apple has implemented what is known as “address space layout randomization” or ASLR, which effectively thwarts such hacking attempts.

To be clear, though, the flaw used by Miller to compromise Apple’s iPhone 4 has not been fully patched.

“If you update your iPhone today, the [MobileSafari] vulnerability is still there, but the exploit won’t work. I’d have to bypass DEP and ASLR for this exploit to work,” Miller said.

The desktop version of Apple’ Safari web browser was also hacked at Pwn2Own this year.

In fact, Safari was the first web browser to get hacked, followed by Microsoft’s Internet Explorer, and Mozilla’s Firefox.

On the first day of the Pwn2Own contest, Vupen security researchers cracked Safari in 5 seconds - a tremendous feat for the hackers, an embarrassing outcome for Apple, which heavily promotes its systems as being far more secure than others’