Ziphone Creator Finds Major iPhone Flaw

The creator of the first widespread application that unlocked iPhones to run on mobile carriers other than AT&T, Piergiorgio Zambrini, has found a bug inside the iPhone, and a nasty one at that. According to the Italian system engineer, the flaw can crash not only the iPhone, but Apple's computers and iPods as well.

Forbes reveals that the bug Zambrini found is located in the audio portion of Apple's video format. It is speculated that some might be willing to pay for that kind of information. TippingPoint, a computer security company that actually buys such vulnerabilities, asserts that an undisclosed flaw like the one Zambrini found can fetch tens of thousands of dollars on the open market. "If he wanted to cash in on it he could always try taking it to us or one of the other exploit-purchasing companies," says Cameron Hotchkies, a reverse engineer and Apple expert at TippingPoint. "The fact that it's in a video file isn't really surprising to me," Hotchkies says. "I'm actually surprised that it's crashing the device rather then [sic] crashing the Web browser because that means he's got a kernel vulnerability in the iPhone."

Hotchkies notes that Microsoft is currently the leading company in security response. However, Apple is right behind it, says the security expert: "Over the past year they've sort of stepped up their security response and their security team," he says. "Usually within a day I get a handwritten follow-up e-mail from someone on their security team telling me who's working on it, so that way I know there's somebody taking a look at it."

Zambrini claims that he will team up with another security expert to continue exploring the bug's potential for malicious applications like arbitrary code injection. Bug-versed folks should already know that such practices can enable hackers to compromise a device, remotely. There's no clear indication that this is the case so far, says Zambrini. Nevertheless, it is fairly possible that it can be done. All it takes is “deeper” studying, the engineer concluded.

A video demonstration of the bug crashing an iPhone is available, courtesy of Forbes.