Skip to main content

iPod/iPhone > News

Thu, 02 Jul 2009 Security Research: Jailbroken iPhones leave users more vulnerable

Jailbreaking a handset may remove up to 80 percent of its security protections

Sumner Lemon

  • Email to a friend
  • Print this article
  • Bookmark this page
  • RSS feed

Jailbreaking an iPhone leaves users vulnerable to attack by stripping away most of the handset's security protections, a security researcher warned on Thursday.

"If you care about security, don't use a jailbroken iPhone," said security researcher Charlie Miller, speaking at the SyScan security conference in Singapore on Thursday.

Jailbreaking is a term used to describe the process of stripping away the protections that prevent a user from installing applications on an iPhone that have not been digitally signed by Apple.

Jailbreaking tools have been popular among users in the US and elsewhere who do not want to be tied to a specific operator, or who want to add software or capabilities to the phone that Apple doesn't offer.

The process removes around 80 per cent of the security protections built into the phone's software, making it more vulnerable, Miller said.

Overall, the stripped-down version of Mac OS X used in the iPhone makes it more secure than computers running the full version of the operating system, Miller said.

Many capabilities contained in the full version of the operating system, like support for Java and Adobe Flash, are not available on the iPhone. In addition, the iPhone doesn't support many of the features contained in PDF files, which have proved to be a fertile source of Mac OS X vulnerabilities. This gives attackers fewer options when looking for vulnerabilities to exploit, he said.

In addition, iPhones are limited to running applications that have been digitally signed by Apple, which means that an attacker cannot simply install and run their own software on the handset. The iPhone also has hardware protections for data stored in memory.

Jailbreaking an iPhone disables these two security functions, making the phone more vulnerable to an attack, Miller said.

Check out our new Macworld Mobile site.

Follow Macworld UK on twitter: www.twitter.com/macworlduk

Email A Friend

Email this article to a friend or colleague:



PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

<<prev article | back to news index | next article>>

Comments received


Steve N said on Thu, 02 Jul 2009

Of course you are more vulnerable, but you are free from the thought police.

lol said on Thu, 02 Jul 2009

I wonder which (Apple) company paid (Apple) for the research?

dave said on Thu, 02 Jul 2009

This really sounds like a FUD report. 80% of all so-called "protection" is gone?

Ridiculous.

Gabriel said on Thu, 02 Jul 2009

Makes perfect sense to me - a lot of the security lies in restricting what the user can do. Remove those restrictions, and you're on your own.

Obviously, some tinkerers here are chafing at those restrictions, but for those of us who want to actually *use* the device, this provides added peace of mind.

Andrew said on Fri, 03 Jul 2009

So based on Mr. Miller's reasoning we should probably only use computers that will only run digitally signed software from the OS vendor? I think it would be a simpler fix to just unplug all computers from any network and remove any input ports - problem of all attack vectors solved.

Andrew said on Fri, 03 Jul 2009

One other point. If Apple allowed basic customization or ways for people to install their own apps, then a jailbreak would be unnecessary. Also, if I could use my phone on another carrier when traveling or after my contract is fulfilled, then there would be no need to unlock. Windows mobile allows for anyone to download and install any software (for 10 yrs now) and there has been no massive security issue. Blackberry too... I can install 3rd party BB software without going through the blackberry store - no giant security hole there either.

thomas said on Mon, 06 Jul 2009

It's amazing how many people complain about Apple's policies. Quite frankly, if you don't like it, don't buy it. Some people like the "security" Apple gives them, while others, like Andrew, are power users. The sarcasm shown by some of these comments, demonstrates the holier-than-thou mentality that many "techies" have toward the rest of the public.

Click here for the latest reader comments

Disclaimer
Opinions expressed here are those of the writers and do not reflect those of Macworld. Macworld accepts no responsibility legal or otherwise for their accuracy of content.
Click here to read the house rules.

Latest News


More news...