iPad, iPhone, iPod Touch Open To Hackers

Apple is a secretive company by nature, but there are always people who were born to take things apart to see how they work and delve into area where they’re not wanted.

One White Hat hacker came up with a program called JailbreakMe 2.0 to allow you to run unapproved apps, themes and tweaks on your iPhone, iPad or iPod Touch.

However, there are also Black Hat hackers out there, too. Jesus Diaz at Gizmodo just released a vulnerability on all three above mentioned gadgets from Apple that don’t even need any action on your part other than opening a PDF file.

From the Gizmodo post:

Right now, if you visit a web page and load a simple PDF file, you may give total control of your iPhone, iPod touch, or iPad to a hacker. The security bug affects all devices running iOS 3.1.2 and higher.

Update: Initially we thought that this exploit only effected iOS4 devices, but it turns out all iPhones, iPod Touches and iPads running 3.1.2 and higher are susceptible.

The vulnerability is easily exploitable. In fact, the latest one-click, no-computer-required Jailbreak solution for iOS 4 devices uses this same method to break Apple’s own security (although in a completely benign way for the user).

How it works

It just requires the user to visit a web address using Safari. The web site can automatically load a simple PDF document, which contains a font that hides a special program. When your iOS device tries to display the PDF file, that font causes something called stack overflow, a technical condition that allows the secret ninja code inside the font to gain complete control of your device.

The result is that, without any user intervention whatsoever, that program can do whatever it wants inside your iPhone, iPod touch or iPad. Anything you can imagine: Delete files, transmit files, install programs running on the background that can monitor your actions… anything can be done.

It’s not just a problem with Apple. Virtually all smart phones are susceptible to hacking and viruses. Security and antivirus apps have yet to catch up. But secrecy is not a good defense.