Infamous Safari Security Cracker Finds Vulnerability-ish in iPhone OS?

Very little code is bullet-proof. Hackers will always find holes. The worst holes will be critical. The worst hacks will be zero-day and found in the wild — catching companies and users both by surprise.

Not sure we have any of that here. Macworld does report that, at the Black Hat Europe Security Conference, former NSA number cruncher Charlie Miller — who has rolled his ability to find exploits in the Mac version of Apple’s Safari Browser into tens of thousands of dollars and a couple free MacBooks at the annual Pwn2Own contest — claims to have:

…found a way to trick the iPhone into running code that enables shellcode. To run shellcode on an iPhone, however, an attacker would first need a working exploit for an iPhone, or a way to target some software vulnerability in, for example, the Safari Web browser or the mobile's operating system. Miller said he doesn't have one now.

Miller previously gained attention for a Mobile Safari exploit that made for some quick early jailbreaking and led to Apple patching the problem in firmware 1.0.1.

What’s particularly disturbing, however, is that Miller also says he’s unsure whether or not Apple knows about the potential vulnerability.

He should know that absolutely dead cold, of course. He should have told Apple long before he made the information public, and only made the information public when Apple had a fix rolled out or ignored his warnings for so long that public pressure could reasonably be considered the only option in getting them to roll out a fix.

Either way, Miller should know that Apple knows because he told them first. Or do we no longer warn people in a house when we see a potential fire starting, but wait and see how much attention and cash we can get for the info first?

This is a story by the iPhone Blog. This feed is sponsored by The iPhone Blog Store.

Infamous Safari Security Cracker Finds Vulnerability-ish in iPhone OS?