Iphone security

fliprich · Apr 20, 2012

I just recently purchased an iPhone 4S. This is my first iPhone and I have some questions about the security of the phone.

I see a lot of people talk about how the iPhone is "virus proof" and how they cant get malware and rootkits, etc. However, I do see a lot of software exploits, mainly buffer overflows that can be used to inject payloads onto the device. I was just wondering what iOS does to prevent these types of attacks because I'm still not totally convinced that the iPhone is completely protected. Please let me know. Thanks.

Skull One · Apr 20, 2012

All software submitted to the App store is vetted by Apple. Is this vetting fool proof? No. Does it catch 99.9% of all malicious apps? Yes.

Currently there are no know apps on the app store that have been able to "break out" of the ASLR design of iOS. The only way to attack this design at present is from the outside. Which means the phone must be hooked to a computer and a specific app must be run to accomplish this.

fliprich · Apr 21, 2012

OK I see. That's pretty awesome. I need to do some research on the iOS. This is pretty interesting. Thanks.

Hel22 · Apr 21, 2012

So if my iphone is acting weird, its usually a problem with a cydia app? never a sort of virus or an app store app?
coz I have terrible lagging problems and iphone being unbearably slow but could be its just the phone dying? its about 2 yrs old. 3GS on iOS 5.0.1

ardchoille · Apr 21, 2012

Best practices on any OS:
1. Understand that there is no such thing as a completely secure OS

2. Be careful what you install or open (trusted sources)

3. Understand that the weakest link on any OS is the user

All of the safeguards in the world aren't going to help of you're willing to install or open anything from anywhere.

I'm speaking from many years of building computers and writing software.

thewitt · Apr 22, 2012

Hel22 said:
So if my iphone is acting weird, its usually a problem with a cydia app? never a sort of virus or an app store app?
coz I have terrible lagging problems and iphone being unbearably slow but could be its just the phone dying? its about 2 yrs old. 3GS on iOS 5.0.1

The only malware attacks on iPhones have been on jail broken phones. Once you start installing software that modifies the core functions of your device, all bets are off...

Mickey330 · Apr 22, 2012

Once again...

The only reported malware attacks on phone have been because people have installed a secure shell (SSH) tweak that allows access to their system (such as OpenSSH) and then did not change their root and mobile passwords. Every iDevice comes with a default password that is known to anyone. If you don't change the password, then yes, access to your phone is possible.

This is what thewitt is talking about - people who did not change their passwords and so had code inserted in their phones.

HOWEVER, If you install an SSH tweak and Change. The. Password. - your iPhone is as safe as a stock iPhone.

If you don't change the password, then you're not as safe - and it's your own fault if something gets in...

Marilyn

fliprich · Apr 22, 2012

I did some scans and some MITM stuff on my iPhone to get an idea on what type of traffic is sent from my iPhone to the web. I noticed TCP 62078 is listening. They say this port is used for the usbmuxd service that syncs the iPhone to iTunes on the laptop and is supposed to be binded to the loopback of the iPhone. But I see it binded to the IP my phone gets from DHCP. I haven't seen any exploits available for this service and I guess it wouldn't matter if scripts cant be run without root priv., but I was just wondering if anyone can elaborate on the usbmuxd service running on TCP 62078.

Skull One · Apr 22, 2012

Do you have wifi sync turned on?

Hel22 · Apr 22, 2012

I have no clue if I installed these kind of apps and how to change password?

zig9449 · Apr 22, 2012

Hel22 said:
I have no clue if I installed these kind of apps and how to change password?

You need MobileTerminal, but the one in Cydia is outdated, and does not work in iOS 5

install iFile from Cydia.

then install Core Utilities from Cydia

Then on your phone, go to this address in Safari: MobileTerminal_520-1_iphoneos-arm.deb - mobileterminal - MobileTerminal_520-1_iphoneos-arm.deb - A GUI Terminal application for the iPhone - Google Project Hosting

Tap on the blue link, let it download, then tap "Open in iFile"

Then tap "Installer"

Now MobileTerminal is installed on your device

Now open Terminal and type the following:

su root (press return)

The type the password. Default password is apline. (letters will no show when you type. After alpine is typed, press return

The type:
cd (press return)

Then type:
passwd (press return)

then type your new password twice.

Change Mobile password by typing:
su mobile (press return)

The type alpine (press return)

Then type;
cd (press return)

then type:
passwd

then type your new mobile password twice.

You iPhone is now 100% safe from any outside attacks (Even tho that never happens any way).

I always do it as a safeguard, but the fact is, is that developers "want" you to use there tweaks, there repos, etc, and the chances of getting a malicious attack on your phone with a default password are very very slim. You are more likely to get attacks from a website in Safari then from any Cydia tweak.

fliprich · Apr 23, 2012

Skull One said:
Do you have wifi sync turned on?

I didn't really see an option to turn it off. I was on a private wifi network though. Do you know if this service is open when on the carrier network. Unfortunately I can't do any scanning over the carrier's network. Lol.

Skull One · Apr 23, 2012

fliprich said:
I didn't really see an option to turn it off. I was on a private wifi network though. Do you know if this service is open when on the carrier network. Unfortunately I can't do any scanning over the carrier's network. Lol.

You turn it off thru iTunes when you sync the phone with a cable. And the service only bonds with your local IP while on WiFi if memory serves.

In fact it might only attach when it is on your home network. When you hooked it to iTunes, it compared network settings on both devices to determine if WiFi sync was viable since they have to be on the same basic subnet. So technically it could truly secure things off if the design was well thought out. But I don't know for sure since I haven't done a full intrusion analysis to see if the port binding is on all WiFi networks or just the SSID at home.

Hel22 · Apr 26, 2012

Hey zigg, I can't find core utilities in cydia, any idea why?

zig9449 · Apr 26, 2012

Hel22 said:
Hey zigg, I can't find core utilities in cydia, any idea why?

Probably because you are setup as User.

In Cydia, tap the "Manage" tab.

Tap Settings in the top left corner.

Then tap Developer.

Now search for it and it will show up.