Hacker News Reader

Comment by adlpz | Hacker News Reader

As people commented on Reddit, this is not significantly different from any jailbreak using a computer. This is USB we are talking about, and the malicious charger in this case is a full-featured Linux computer.

So yes, they are installing unsigned software through USB on an iPhone by plugging it into a USB socket in a computer. That is just normal jailbreaking, and has been done forever, isn't it?

View on HN

I think the big difference here is that people willingly plug their phones into the airport kiosk chargers, share chargers, use car-based usb plugs, and generally don't even think of it as an attack vector.

On another note, I've been amazed by the number of people who let others plug phones into their computer for a quick charge.

I'll let people borrow my wall charger if I'm sitting there but no one plugs anything into my computer.

>no one plugs anything into my computer.

I believe the same, including vice versa for that matter. (That is, I would never plug a phone into somebodies computer.)

Thank you for pointing this out.

The researchers are using a Beagleboard device for the exploit. Based on what they've said to the press so far, it sounds like a no-interaction tethered jailbreak (if it's truly functional on all Apple devices) or at best an untethered jailbreak on limited Apple devices.

If this presentation is claiming the ability to install software on ALL non-jailbroken Apple devices running the latest OS version that survives a reboot of the device (once it's detached from the charger), then that's potentially worth more than any "malicious USB charger" talk (since the jailbreak community is currently unable to to do this).

Dock speakers connect to the iphone through the same interface. The high end ones have ARM cores, they have wifi, they might even run Linux. There is a theoretical chain of trojan --internet--> PC --wifi--> speaker --usb--> iphone.

This is, of course, insanely unlikely today. But in a few years, when everything has a 1GHz ARM core and an internet connection, we very well might start seeing malware that jumps devices and infects entire households.

I believe "normal" jailbreaking requires the phone to be unlocked. This works without any user action. When the phone is locked everything is supposed to be encrypted and secured.

I'm unfamiliar with the exact process of jailbreaking; if a phone is unlocked but plugged into a separate computer, you can essentially run arbitrary code on the phone if you are controlling the computer it's connected to?

Not really, in fact I believe some methods even reboot the system into a recovery mode without any user interaction, so given a vulnerability, there are definitely ways of interacting with the phone without it being unlocked.

But do they start that process with it being locked? It's one thing to inject code while unlocked and another to take control of a locked phone.

The whole locked phone thing is just a graphical and OS feature. If the OS is vulnerable to a remote injection it might just as easily bypass the locked state.

Reply on news.ycombinator.com