14 DAY TRIAL // Security experts are concerned that a vulnerability exploited by a new iOS remote jailbreak might be leveraged by cyber criminals to infect devices with malware.
Version 3.0 of the famous JailbreakMe remote jailbreak was released yesterday. The new variant has quickly gained popularity because it also works for the new iPad 2.
The jailbreak works by exploiting a previously unknown vulnerability in the iOS PDF parser which allows the remote execution of arbitrary code.
Security researchers warn that the same exploit can be adapted by cyber criminals to install malware on devices by simply tricking victims into visiting a specially-crafted web page.
"If they exploited the same vulnerability in a copy-cat manoeuvre, cybercriminals could create booby-trapped webpages that could - if visited by an unsuspecting iPhone, iPod Touch or iPad owner - run code on visiting devices.
"A website like JailBreakMe is making it easy to jailbreak your iPhone or iPad - but it could also be said to be giving a blueprint to malicious hackers on how to infect such devices with malware," warns Graham Cluley, a senior technology consultant at antivirus vendor Sophos.
Comex admits that this is possible, but claims that public knowledge of such flaws help make iOS safer. This stance is similar to that of security researchers practicing full disclosure.
"Although releasing a jailbreak is certainly not the usual way to report a vulnerability, it still has the effect of making iOS more secure in the long run," the hacker says.
Last year when comex released JailbreakMe version 2 based on a similar vulnerability, Apple responded with a patch in around ten days. However, people who choose to jailbreak their devices can plug the security hole right away by installing the PDF Patcher 2 application through Cydia.