10 Things that "Absolutely suck" about the iPhone. (Yes I have one)

[surur]

That's some twisted reasoning. First of all, we know for a fact that not all changes were reported by Apple. There are several visible changes that don't show up on the change log. There are also several apparent bug fixes that don't show up on the change log.

Second, we don't know that crashes can be used for exploits. In the report you are talking about (http://www.securityevaluators.com/iphone/) they are clearly speculating; the actual exploit they reported had nothing to do with crashing. I've seen no proof that a crash can lead to arbitrary code execution, and if it's using protected code pages it seems that it can't.

What they say is:

"Is it likely that there are other vulnerabilities in the iPhone?

It's a near certainty. For example, every cause of Safari crashing on the iPhone is a potential vulnerability. And getting Safari on the iPhone to crash isn't that hard. Additionally, it's likely there are vulnerabilities in the other iPhone applications as well."

The actual "arbitrary code" thing is arbitrary web page code that gets executed without you intending - and that was supposedly fixed.

You say you are "assuming" but you originally stated your assertion as a fact. But this report says nothing about crashes resulting in arbitrary code being run, says nothing about root (though i've seen that referred to elsewhere), and the published exploit has nothing to do with crashes or root.

Arbitrary code execution is not arbitrary javascript execution

And you said you were a professional!

Surur

 

[cmaier]

Arbitrary code execution is not arbitrary javascript execution

And you said you were a professional!

Surur

You are making my point. I've seen nothing revealed about CRASHES causing arbitrary code execution.

The only exploit those guys announced had to do with you going to a webpage that does NOT cause a crash, but which allows running of arbitrary code. The way they do this had to do with, apparently, a buffer overflow caused by executing arbitrary javascript or some other html structure, or somehow screwing with the networking stack. In the end, it required a bogus access point, cross-site scripting, or some other way to get you to the bad web page.

But, and here's the point: the only mention of "crash" comes in that language I quoted, which was speculation about other possible attacks. The "crash" discussion had nothing to do with arbitrary code or with root.

 

[surur]

You are making my point. I've seen nothing revealed about CRASHES causing arbitrary code execution.

The only exploit those guys announced had to do with you going to a webpage that does NOT cause a crash, but which allows running of arbitrary code. The way they do this had to do with, apparently, a buffer overflow caused by executing arbitrary javascript or some other html structure, or somehow screwing with the networking stack. In the end, it required a bogus access point, cross-site scripting, or some other way to get you to the bad web page.

But, and here's the point: the only mention of "crash" comes in that language I quoted, which was speculation about other possible attacks. The "crash" discussion had nothing to do with arbitrary code or with root.

Again, I am concerned by your understanding of buffer overflows and how they work. Did you really do x64 work, or were you making that up?

I will try and explain it in simple language. A program receives data (e.g a web page or an mp3 etc) in a buffer. If the programmer did not put enough checks in, the data can over run the buffer the programmer prepared to accept the data. Thats a buffer overflow. This can commonly cause a crash.

However, if the data is specially crafted, the hacker may overrun registers which tell the OS which command to execute next. Execution passes to the code the hacker just injected into the buffer, and his code can do anything, including download further code for example, install a root kit, send 1000's of sms's to premium numbers etc.

Read more here. http://en.wikipedia.org/wiki/Buffer_overflow

Arbitrary code means arbitrary code. I assume your use of a mac at home explains your lack of education.

Surur

 

[AnteL0pe]

Are you sure about that? This post seems to disagree.

Yes i just spoke to someone at ATT and had it set up.

Sorry, you will have to do your maths again. And apparently without a plan its $0.02 per kilobyte, or $20.48 per megabyte. Your 33.8 megabytes will cost you $690

Surur

But I am not without a plan, thats the whole point. I have the plan, thats why its $.005. Stop making things up.

 

[cmaier]

Again, I am concerned by your understanding of buffer overflows and how they work. Did you really do x64 work, or were you making that up?

I will try and explain it in simple language. A program receives data (e.g a web page or an mp3 etc) in a buffer. If the programmer did not put enough checks in, the data can over run the buffer the programmer prepared to accept the data. Thats a buffer overflow. This can commonly cause a crash.

However, if the data is specially crafted, the hacker may overrun registers which tell the OS which command to execute next. Execution passes to the code the hacker just injected into the buffer, and his code can do anything, including download further code for example, install a root kit, send 1000's of sms's to premium numbers etc.

Read more here. http://en.wikipedia.org/wiki/Buffer_overflow

Arbitrary code means arbitrary code. I assume your use of a mac at home explains your lack of education.

Surur

Wow, nice. The only thing more annoying than the fact that you have no idea what you are talking about is that you think you do.

Why don't you look up "protected page." On modern microprocessors, a memory page can be marked in various ways (read-only, etc.) One thing that is commonly done now (even on x86-64) is to mark a page as "code" or "data." You cannot execute code on a data page, and you cannot modify (via buffer overflow) a code page.

Yes, as I pointed out, x86 does not have such protections (while x86-64 does), but almost every other modern architecture (i assume ARM) does.

Thus if i overflow my buffer, all i can do is corrupt a data page. I can never actually execute any code i put into memory that way, as it is on a data page and the CPU will refuse to execute it.

x86 suffers from this problem because it was designed to permit self-modifying code, and mixed data/code pages. You may know of something called DEP (Data Execution Protection) that you can do in windows xp IF you are running on an x86-64 chip that supports it (like the one I designed). Any time you try to executed a data page, it kills the program and gives you a message. This is hardware level protection, and other processors have it too.

And, mr. expert, you don't "overrun registers." Registers are not the same thing as memory. Registers exist within the cpu, and you can't "overrun them" by overrunning a buffer. Buffers are arrays in memory.

And just because "buffer overflows" CAN cause a crash doesn't mean they necessarily allow arbitrary code to run. You are substituting your own paltry excuse for knowledge in place of actual references because you got caught making up what the exploit report said.

 

[cmaier]

Apparently (at least some) ARM processors do support the sort of memory protection to which I have consistently referred:


http://www.arm.com/products/CPUs/ARM_Cortex-M3.html

See "Memory Protection Unit."

Again, I am concerned by your understanding of buffer overflows and how they work. Did you really do x64 work, or were you making that up?

I will try and explain it in simple language. A program receives data (e.g a web page or an mp3 etc) in a buffer. If the programmer did not put enough checks in, the data can over run the buffer the programmer prepared to accept the data. Thats a buffer overflow. This can commonly cause a crash.

However, if the data is specially crafted, the hacker may overrun registers which tell the OS which command to execute next. Execution passes to the code the hacker just injected into the buffer, and his code can do anything, including download further code for example, install a root kit, send 1000's of sms's to premium numbers etc.

Read more here. http://en.wikipedia.org/wiki/Buffer_overflow

Arbitrary code means arbitrary code. I assume your use of a mac at home explains your lack of education.

Surur

 

[surur]

Apparently (at least some) ARM processors do support the sort of memory protection to which I have consistently referred:


http://www.arm.com/products/CPUs/ARM_Cortex-M3.html

See "Memory Protection Unit."

Your faith in Apple is endearing, but exploitingiphone, acknowledged by Apple in that update, says the heap is executable.

Unfortunately, once an iPhone application isbreached by an attacker, very little prevents an attacker from obtaining complete control of the system. All the processes which han-dle network data run with the effective user id of 0, i.e. the superuser. This means that a compromise of any application gives the abil-ity to run code in the context of that applica-tion which has the highest possible privilege level. Additionally, no address randomization was used in by the operating system. This means that each time a process runs, the stack, heap, and executable code is located at precisely the same spot in memory. This helps attackers write reliable exploit code by allowing them to guess the layout of memory from run to run of an application and even from device to device. Most modern operat-ing systems incorporate some sort of address randomization. Additionally, the heap (and possibly the stack) is executable. Again, this has the effect of making exploit development easier for an attacker as it allows them to simply place their code on the heap and jump to it once they have control of the program. Had these precaution been taken, it would have forced attackers to use more sophisti-cated methods of exploitation such as return-to-libc. Therefore, while precautions were made to reduce the amount of code available to a remote attacker, once a vulnerability is located it is relatively easy for them to suc-cessfully exploit and obtain complete control of the device.

http://64.233.183.104/search?q=cach...exploitingiphone.pdf&hl=en&ct=clnk&cd=1&gl=uk

Why do you assume Apple is using specific security features when everything so far demonstrates they dont?

Surur

 

[mikec#IM]

Apple Sinks on iPhone Cutback Talk

Rumours rumours.

Wouldn't put much stock in it until real numbers come out; we're only 60 days until 1M units, right?

 

[cmaier]

Your faith in Apple is endearing, but exploitingiphone, acknowledged by Apple in that update, says the heap is executable.


http://64.233.183.104/search?q=cach...exploitingiphone.pdf&hl=en&ct=clnk&cd=1&gl=uk

Why do you assume Apple is using specific security features when everything so far demonstrates they dont?

Surur

THe only one assuming is you. You assume there are no changes in the update that are not on the published list, despite the fact that we know that's not true. You assume(d) that:

- safari runs as root (even the paragraph above doesn't say that. it is talking about the network stack, not safari)
- if you run as root and crash, you necessarily can run arbitrary code (again, not true if protected memory features are used)
- registers are the same thing as memory
- you know more about microprocessor architecture than everyone else

If Apple is not using the security features available in the microprocessor, then shame on them. Based on the cited text, it appears that prior to this update they did not, at least not to the degree they should have. But unlike you, I don't just make assumptions. I look for actual facts and data to support a reasonable conclusion.

And your original statement was, to paraphrase:

safari still (unknown if there were changes) runs as root (not true. that's the network stack) and therefore a crash can lead to executing arbitrary code (a crash is not necessary to use a buffer overflow exploit, though buffer overflow exploits can be defeated entirely via hardware precautions.)

Unlike you, I never stated as fact that Apple hardware behaved a certain way. I simply pointed out that modern microprocessor generally support the protection to which i referred, found a source that showed that at least some ARM processors do support that hardware, and suggested that this meant that iphone could be immune from that particular kind of attack.

And, since you don't know the difference between a register and memory, i highly doubt you know what a "heap" is (though I'm sure you'll run over to the wikipedia to figure it out).

 

[mikec#IM]

THe only one assuming is you. You assume there are no changes in the update that are not on the published list, despite the fact that we know that's not true. You assume(d) that:

- safari runs as root (even the paragraph above doesn't say that. it is talking about the network stack, not safari)
- if you run as root and crash, you necessarily can run arbitrary code (again, not true if protected memory features are used)
- registers are the same thing as memory
- you know more about microprocessor architecture than everyone else

If Apple is not using the security features available in the microprocessor, then shame on them. Based on the cited text, it appears that prior to this update they did not, at least not to the degree they should have. But unlike you, I don't just make assumptions. I look for actual facts and data to support a reasonable conclusion.

And your original statement was, to paraphrase:

safari still (unknown if there were changes) runs as root (not true. that's the network stack) and therefore a crash can lead to executing arbitrary code (a crash is not necessary to use a buffer overflow exploit, though buffer overflow exploits can be defeated entirely via hardware precautions.)

Unlike you, I never stated as fact that Apple hardware behaved a certain way. I simply pointed out that modern microprocessor generally support the protection to which i referred, found a source that showed that at least some ARM processors do support that hardware, and suggested that this meant that iphone could be immune from that particular kind of attack.

And, since you don't know the difference between a register and memory, i highly doubt you know what a "heap" is (though I'm sure you'll run over to the wikipedia to figure it out).

Isn't a "heap" the amount of cash you fork over to buy and use and iPhone?

Sorry, couldn't resist, but I for one am enjoying the ping pong....

 

[surur]

THe only one assuming is you. You assume there are no changes in the update that are not on the published list, despite the fact that we know that's not true. You assume(d) that:

- safari runs as root (even the paragraph above doesn't say that. it is talking about the network stack, not safari)
- if you run as root and crash, you necessarily can run arbitrary code (again, not true if protected memory features are used)
- registers are the same thing as memory
- you know more about microprocessor architecture than everyone else

If Apple is not using the security features available in the microprocessor, then shame on them. Based on the cited text, it appears that prior to this update they did not, at least not to the degree they should have. But unlike you, I don't just make assumptions. I look for actual facts and data to support a reasonable conclusion.

And your original statement was, to paraphrase:

safari still (unknown if there were changes) runs as root (not true. that's the network stack) and therefore a crash can lead to executing arbitrary code (a crash is not necessary to use a buffer overflow exploit, though buffer overflow exploits can be defeated entirely via hardware precautions.)

Unlike you, I never stated as fact that Apple hardware behaved a certain way. I simply pointed out that modern microprocessor generally support the protection to which i referred, found a source that showed that at least some ARM processors do support that hardware, and suggested that this meant that iphone could be immune from that particular kind of attack.

And, since you don't know the difference between a register and memory, i highly doubt you know what a "heap" is (though I'm sure you'll run over to the wikipedia to figure it out).

cmaier, let go of the heap thing. I was just simplifying things for you.

Again, your faith in Apple is endearing. Safari runs as root.

No one said all crashes can be exploited, but a crash shows where the problems handling data are.

I dont know more than everyone about processors, but I sure seem to know more about security than you.

Surur

 

[cmaier]

Let's stick to the people who actually managed an exploit rather than some random website which is guessing based on reading a crash log: http://www.securityevaluators.com/iphone/exploitingiphone.pdf

You quoted the language yourself. "the processes which handle networking" is not the same thing as "safari." It's the network stack.

"No one said all crashes can be exploited." You did:

Message 2146: "..meaning every crash is a potential arbitrary code execution" (go ahead and now overemphasize "potential")

Message 2157: "we now know...that the claim that a safari crash can lead to arbitrary code execution is real."

Message 2157: "the hackers who created the exploit said any safari crash is a potential exploit. Safari still crashes."

Message 2163: "if the data is specially crafted, the hacker may overrun registers...and his code can do anything."

At the very least, as your statements evolved, they evolved to the point of "any buffer overrun can be exploited."

And now you show further ignorance with "crash shows where the problems handling data are." Really? So all crashes are caused by "problems handling data?"

You don't know squat about security, microprocessors, operating systems, programming, or the iphone. Every time you open your own mouth and try to state something as fact as opposed to copying and pasting other people's complaints you show your ignorance.

You still haven't explained why when we know things have changed which were not on the official list, we should assume that nothing else security-related changed. I'm not assuming it has, I'm waiting for data, but you are assuming it hasn't.

"I was just simplifying things for you." Actually, it was the register thing, not the heap thing, and I can assure you you don't need to simplify for me. (And you're full of it. No one would simplify "memory" into "register." Who takes a generic term and turns it into a term-of-art to simplify something?)

 

[mikec#IM]

Let's stick to the people who actually managed an exploit rather than some random website which is guessing based on reading a crash log: http://www.securityevaluators.com/iphone/exploitingiphone.pdf

You quoted the language yourself. "the processes which handle networking" is not the same thing as "safari." It's the network stack.

"No one said all crashes can be exploited." You did:

Message 2146: "..meaning every crash is a potential arbitrary code execution" (go ahead and now overemphasize "potential")

Message 2157: "we now know...that the claim that a safari crash can lead to arbitrary code execution is real."

Message 2157: "the hackers who created the exploit said any safari crash is a potential exploit. Safari still crashes."

Message 2163: "if the data is specially crafted, the hacker may overrun registers...and his code can do anything."

At the very least, as your statements evolved, they evolved to the point of "any buffer overrun can be exploited."

And now you show further ignorance with "crash shows where the problems handling data are." Really? So all crashes are caused by "problems handling data?"

You don't know squat about security, microprocessors, operating systems, programming, or the iphone. Every time you open your own mouth and try to state something as fact as opposed to copying and pasting other people's complaints you show your ignorance.

You still haven't explained why when we know things have changed which were not on the official list, we should assume that nothing else security-related changed. I'm not assuming it has, I'm waiting for data, but you are assuming it hasn't.

"I was just simplifying things for you." Actually, it was the register thing, not the heap thing, and I can assure you you don't need to simplify for me. (And you're full of it. No one would simplify "memory" into "register." Who takes a generic term and turns it into a term-of-art to simplify something?)

Did something just get thown down?

 

[surur]

Let's stick to the people who actually managed an exploit rather than some random website which is guessing based on reading a crash log: http://www.securityevaluators.com/iphone/exploitingiphone.pdf

You quoted the language yourself. "the processes which handle networking" is not the same thing as "safari." It's the network stack.

"No one said all crashes can be exploited." You did:

Message 2146: "..meaning every crash is a potential arbitrary code execution" (go ahead and now overemphasize "potential")

Message 2157: "we now know...that the claim that a safari crash can lead to arbitrary code execution is real."

Message 2157: "the hackers who created the exploit said any safari crash is a potential exploit. Safari still crashes."

Message 2163: "if the data is specially crafted, the hacker may overrun registers...and his code can do anything."

At the very least, as your statements evolved, they evolved to the point of "any buffer overrun can be exploited."

First, do you understand English? You understand potential, may, can, if etc? If so, how do you translate it into "all"? I started doubting your credentials, now I am doubting your intelligence.

And now you show further ignorance with "crash shows where the problems handling data are." Really? So all crashes are caused by "problems handling data?"

Please dont go setting up straw men. And read up on fuzzing.
http://en.wikipedia.org/wiki/Fuzz_testing

Surur

 

[oalvarez]

regardless of what Surur and his copied/pasted threads might say,

i still like my iPhone

 

[mikec#IM]

First, do you understand English? You understand potential, may, can, if etc? If so, how do you translate it into "all"? I started doubting your credentials, now I am doubting your intelligence.



Please dont go setting up straw men. And read up on fuzzing.
http://en.wikipedia.org/wiki/Fuzz_testing

Surur

Parry and thrust...

 

[surur]

The iPhone unintuitive and arkward? Maybe it needs a start menu...

- My problem with the iPhone.

The General 08-01-2007 11:07 AM

--------------------------------------------------------------------------------

My problem with the iPhone.

After a month of using my iPhone, I finally figured out what my problem was with it, and why other people were so confused when trying to use it. It's not to do with lacking features or needing a software update, or even the instability problems that plague Safari. It's just a strange design that is not entirely intuitive.

One problem is that various web tasks that would normally all be done in Safari are separated into different Applications. For instance, when I show someone a video on YouTube, and they want to go to Google, they get all confused and can't figure it out. Instead of just going from www.youtube.com to www.google.com, you have to press the Home Button and tap on Safari. Same thing in reverse, if someone wants to show me a video (I won't even get into the lack of video content from YouTube today), they try and find it in Google, which churns up videos on MetaCafe, eBaums World, Google Videos, Myspace Videos, YouTube, etc ... And only some videos from one of those sources works on the iPhone. People get disappointed when that happens.

Another example of this is Google Maps. I show someone a location on Google Maps, and they, for example, go to the website of King's Mongolian BBQ in Northridge to see what's up with the place, getting back to the map is very confusing for them. Instead of just hitting back, or switching tabs ... you have to, once again, press the home button and then tap Google Maps. If they could some how get Safari to distiguish between AJAX "dragging" and normal scrolling, then maps.google.com would get a lot more use from me.

YouTube, Google Maps, and Safari need some sort of integration other than their ability to open eachother with links. Once the Flash plugin comes out, I'll probably just use Safari.

Oh, and the physical home button really confuses people some times. I've had to say "it's a real button" probably 20 times.

badtzmaru 08-01-2007 11:57 AM

--------------------------------------------------------------------------------

i do wish there were a faster way to switch between apps.

http://forums.macrumors.com/showthread.php?t=33629

Surur

 

[braj]

Everything will be unintuitive and awkward to some people. The iPhone sounds very similar to a Treo in dealing with Google Maps, Blazer and YouTube (via Kinoma, which sucks btw). I agree that it would be nice to if YouTube, Google Maps, and Safari had some more integration, but specific widgets to get web content seems more efficient to me than doing everything within Safari.

 

[surur]

Oops! Update problems...

- The Update Is Tearing Apart My Iphone!!!

SUPERSTEVE9219 08-01-2007 04:12 AM

--------------------------------------------------------------------------------

The Update Is Tearing Apart My Iphone!!!

Ok well I had a perfect iPhone you could say, no problems whatsoever, no polkadots, loud speaker, good battery life. Ok after the update my phone worked good for the first 30 mins then it froze. I did a hard reset and it was fine for 10 mins and it froze and I had to do another hard reset, after that it wouldnt go any longer than 7 to 8 mins. But that was the only problem, so I was trying to post this and my iPhone wouldn't stay logged into any page, I would log in then go to another page and it would ask me to log back in, so posting this from my iPhone was impossible. Then my the WiFi totally stopped working, it wouldn't connect to my default network or any other network. Oh no but thats not it, the clicks when typing where extremely loud then the speaker started cracking and its tone completely change from that sharp click to a low click with lots of cracking and the volume just kept droping intel it was almost impossible to hear.

****ing great, now my home menu is completely blank and only shows the AT&T, signal, time, and battery.


Anyone else having problems? Im going to do a system restore, hopefully that fixes it


added:
Checked all apps, no issues.
Leaving for work now. If I have any issues, I'll post from phone. Good luck all.

yoman 08-01-2007 06:30 AM

--------------------------------------------------------------------------------

Wirelessly posted (Mozilla/5.0 (iPhone; U; CPU like Mac OS X; en) AppleWebKit/420+ (KHTML, like Gecko) Version/3.0 Mobile/1C25 Safari/419.3)

do you or did you have any mods or custom ringtones installed on your iphone during or after the update? That could be the problem. Have you done a software restore? That seems to have solved many iphone users problems with the update.

javaGuru 08-01-2007 06:57 AM

--------------------------------------------------------------------------------

Quote:

--------------------------------------------------------------------------------

Originally Posted by SUPERSTEVE9219 (Post 3986921)
Ok well I had a perfect iPhone you could say, no problems whatsoever, no polkadots, loud speaker, good battery life. Ok after the update my phone worked good for the first 30 mins then it froze. I did a hard reset and it was fine for 10 mins and it froze and I had to do another hard reset, after that it wouldnt go any longer than 7 to 8 mins. But that was the only problem, so I was trying to post this and my iPhone wouldn't stay logged into any page, I would log in then go to another page and it would ask me to log back in, so posting this from my iPhone was impossible. Then my the WiFi totally stopped working, it wouldn't connect to my default network or any other network. Oh no but thats not it, the clicks when typing where extremely loud then the speaker started cracking and its tone completely change from that sharp click to a low click with lots of cracking and the volume just kept droping intel it was almost impossible to hear.

****ing great, now my home menu is completely blank and only shows the AT&T, signal, time, and battery.


Anyone else having problems? Im going to do a system restore, hopefully that fixes it
--------------------------------------------------------------------------------



Just currious, but did you use some of the program hacks to install ringtones to your iphone?

SUPERSTEVE9219 08-01-2007 01:04 PM

--------------------------------------------------------------------------------

No my iPhone was hack and ringtone free, I eventually got it working but it took a long time, first iTunes wouldn't recognize my iPhone and my iPhone wouldn't go into sync mode, I eventually got it to work but it took forever to restore it like a hour.

It seems to be working but ill report back after I use it for a while

rodneyi 08-01-2007 01:27 PM

--------------------------------------------------------------------------------

I've had the exact same problems. The update made me do a restore because of the jailbreak hack. Since the update my phone will freeze up when I unlock the phone from sleep mode with a black screen and just the top bar showing. One time it froze on the slide to unlock screen and wouldn't let me unlock the phone. I've had to hard reset my phone about 4 times now. I also cannot get connected to my wi-fi network anymore and my yahoo push mail keeps trying to connect and load emails. All of this has caused a rapid battery drain on my phone. After the hard reset, the usage meter is not even working as well. This bites!

http://forums.macrumors.com/showthread.php?t=336201

Surur

 

[Pearl_Diva]

If they add enough firmware updates by Christmas, and one of them includes IM, OR there are rumors of another updated model(that's common with Apple) with more features, the iPhone will then be added to my list.

I never wrote the iPhone off entirely, it's just that the first edition is too limited for the price.