Security-Protocols

A guy who uses the handle NerveGas on #iphone has figured out how to enable ssh on the iPhone without using the iPhone restore mode as it does not work with all public version of iPhoneInterface. The secret is in overwriting the ‘update’ binary with ‘chmod’ and the plist to trick the iPhone into calling ‘chmod’ on the Dropbear ssh server which makes it an executable. Boom! We now can ssh into our iPhone to send and retrieve files using sftp and or to do other neat things.

gdb anyone?

NerveGas used Nightwatch’s compiler to create iPhone-compatible versions of curl and ps as well as a number of other useful Unix utilities. Big thanks to NerveGas for this!

Links:

http://iphone.fiveforty.net/wiki/index.php/Dropbear-ssh
http://netkas.freeflux.net/blog/archive/2007/07/22/iphone-binary-shell-compiled.html
http://pastebin.com/m7abdb007

This was taken from the iPhone Wiki Development site:

<@gj> we are focusing all of our efforts at the moment on the restore process because
<@gj> we have noticed the following functions in restored_externak:
<@gj> external:
<@gj> CreateTextFile
<@gj> SetNVRam
<@gj> UpdateBaseBand
<@gj> UpdateNOR
<@gj> these filesystem functions are the key to permitting us to do interesting things because they will open up access to the device further
<@gj> in addition, we have successfully gotten a dmg onto the phone
<@gj> we are working on a tool for this
<@gj> I can’t confirm that the dmg will actually be readable.
<@gj> or that the phone will do anything with it
<@gj> but we have a tool that does decryption/re-encryption which may be released this evening depending on the moon’s phase and the tides
<@gj> we have a generic shell that does interesting stuff with the phone
<@gj> we are extending it to cover the restore process
<@gj> because we want to be able to issue these commands
<@gj> our proof of concept is solid, we seem to be able to issue the commands
<@gj> so
<@gj> that’s where we stand
<@gj> we have a lot of work ahead
<@gj> don’t ask me silly questions like “how long”
<@gj> because if I had that answer you would have it too
<@gj> let’s see, final notes
<@gj> we hit engadget (again) and have been interviewed for some periodical in brazil
<@gj> hopefully the report will come out positive
<@gj> the dev team has some tshirts in progress, two versions
<@gj> one for the “official” team and one for interested parties
<@gj> the interested party ones will sell, not sure about giving them out to donators, that will be up to the people running the donation piece
<@gj> i’m still working “PR” as it were
<@gj> appreciate all the offers of help
<@gj> my phone is at the dev team’s disposal and my contributions are mostly around the touchscreen and radio side
<@gj> I am working hard on deciphering some of that, you can see my notes on the wiki [[Gj’s curiosities]]
<@gj> anyway, that’s all

I can tell you this, they are very very close to overwriting the firmware. There is defiantly a race among many researchers around the world right now as to who will successfully unlock the iPhone as well as the SIM card.

Also if you have an iPhone and would like to spice it up with some wallpapers, check out: ThemeMyPhone.com.

Derek Soeder from eEye Digital Security has recently released a paper on “Memory Retrieval Vulnerabilities“.  The paper discusses  theoretical coding flaws which may offer an attacker a  peak into the heap or stack, or even possibly arbitrary process memory which may allow the creation of more reliable exploits.  The paper also includes some nice code examples and demonstrations.  You can get the paper here:

Memory Retrieval Vulnerabilities

Tavis Ormandy has released scanmem which is a debugging utility designed to islolate the address of an arbitrary variable within an executing process. Scanmem simply needs to be told the pid of the process, and the value of the variable at several different times. After several scans of the process, scanmem isolates the position of the variable which allows you to modify its value.

Version 0.02 of scanmem only lets you search for dwords. Maybe Tavis will release a complete version which would be pretty slick. Thanks for the neat tool!

You can download scanmem at the link below:

http://freshmeat.net/projects/scanmem/