Your favorite Apple, iPhone, iPad, iOS, Jailbreak, and Cydia site.
Thread: iPhone Security Hole Discovered - View iPhone Passwords
is a discussion within theiPhone News
forums, a part of theGeneral iPhone
section;Just submitted to Apple as a bug, rpetrich (developer of the ActionMenu packages in Cydia) discovered an interesting security bug in the iPhone firmware. If a password is inputted in
...
LinkBack URL
About LinkBacks-
09-13-2009, 07:59 PM #1Owner / Founder - ModMyi
aka poetic_folly
- Join Date
- May 2007
- Location
- Tampa, Florida, United States
- Posts
- 8,351
- Thanks
- 529
- Thanked 4,565 Times in 1,158 Posts
iPhone Security Hole Discovered - View iPhone Passwords
Just submitted to Apple as a bug, rpetrich (developer of the ActionMenu packages in Cydia) discovered an interesting security bug in the iPhone firmware.
If a password is inputted in a field, shake to undo, and you will be able to see the character you are deleting. Simply repeat this for every character, and you have the password.
Obviously this isn't an issue that would be useful for those with a criminal bent, as you'd have to be within grabbing distance of someone who input their password, DIDN'T navigate off the page, and then left their iPhone... but a security bug none-the-less. EDIT: rpetrich lets us know, this also works in any apps that save passwords (such as most Twitter apps) - making this bug much more severe.
EDIT AGAIN: This seems to have been fixed in FW 3.1. Which is NOT a good enough reason to upgrade yet, heh - wait for the jailbreak.
EDIT 3: The guys over at NeoWin made up a video showing this bug:
You can submit security bugs to Apple here.
rpetrich's Twitter
-
The Following 2 Users Say Thank You to Kyle Matthews For This Useful Post:
black_orchid (09-13-2009), Kiserai (09-13-2009)
-
09-13-2009, 08:04 PM #2
What about the ones who have auto-fill turned on? Doesnt that remember passwords hence the bug would work for someone to steal your password if they had your device?
If I helped you, hit the
button or be Banned!
Download Macbook 3.1 for Winterboard-Now LIVE on Cydia-Macbook Final, Macbook Final Widget,Macbook SBSettings
Need Hardware Repair Support?: PM ME
-
-
09-13-2009, 08:28 PM #3iPhone? More like MyPhone
- Join Date
- Sep 2007
- Location
- South Central LA
- Posts
- 174
- Thanks
- 27
- Thanked 19 Times in 13 Posts
oh my oh my now thats scary =S
which FW s this for??...3.1??Last edited by FURBY8704; 09-13-2009 at 08:36 PM.
iPHONE 3G FW 4.0 JB & iPHONE 4 4.0 READY TO BE JB=]
-
09-13-2009, 08:57 PM #4
Hmmm tried it on my phone in Safari but doesn't seem to happen to me. Maybe I'm doing it wrong? On iPhone 3G 3.1
-
09-13-2009, 09:01 PM #5iPhone? More like MyPhone
- Join Date
- Sep 2008
- Location
- U.S.
- Posts
- 163
- Thanks
- 31
- Thanked 22 Times in 16 Posts
its not a defect...its a feature..
-
09-13-2009, 09:41 PM #6It's been fixed for for 3.1. You're good.
Originally Posted by RandyC
-
09-13-2009, 09:59 PM #7
ya this didnt happen to me in the youtube app
-
09-13-2009, 10:01 PM #8
all i wanna know is "will i ever be able to jailbreak 3.1 or not??"
-
09-13-2009, 10:11 PM #9Don't hijack this thread. It has absolutely nothing to do with a jailbeak... Originally Posted by mrguy
Visit http://blog.iphone-dev.org/ for info on a jailbreakIf I helped you, hit the button or be Banned!
Download Macbook 3.1 for Winterboard-Now LIVE on Cydia-Macbook Final, Macbook Final Widget,Macbook SBSettings
Need Hardware Repair Support?: PM ME
-
09-13-2009, 10:44 PM #10Green Apple
- Join Date
- Jul 2009
- Location
- On the Internet ツ
- Posts
- 41
- Thanks
- 1
- Thanked 2 Times in 2 Posts
if you are trying to do it yourself to see if it works, you have to wait a bit after you type your password or after you start to delete each character or else when u shake to undo, it will undo the whole password or all of the deletes you did to get to the other characters (if that makes sense) ... this bug def works so an easy fix would be not to auto save passwords or keep your phone tight in your hands when inputting a pw
-
09-13-2009, 10:53 PM #11Retired Moderator
- Join Date
- Jan 2008
- Location
- TX Follow me @StealthBravo
- Posts
- 32,492
- Thanks
- 44
- Thanked 5,326 Times in 3,113 Posts
It works and is amazing.
-
09-13-2009, 11:19 PM #12
^Remind me to keep my phones away from you
If I helped you, hit the button or be Banned!
Download Macbook 3.1 for Winterboard-Now LIVE on Cydia-Macbook Final, Macbook Final Widget,Macbook SBSettings
Need Hardware Repair Support?: PM ME
-
09-13-2009, 11:28 PM #13Retired Moderator
- Join Date
- Jan 2008
- Location
- TX Follow me @StealthBravo
- Posts
- 32,492
- Thanks
- 44
- Thanked 5,326 Times in 3,113 Posts
good idea. But there are easier ways to get your passwords
-
09-13-2009, 11:35 PM #14Custom Title
- Join Date
- Jun 2009
- Location
- The Golden State :)
- Posts
- 3,840
- Thanks
- 22
- Thanked 221 Times in 210 Posts
Please don't Originally Posted by Melech518
I'm going crazy with the "When is 3.1 jailbreak out?" posts...I always feel sorry for the guy in the iPhone commercials. He always gets a call right in the middle of trying to do something
-
09-13-2009, 11:38 PM #15Retired Moderator
- Join Date
- Jan 2008
- Location
- TX Follow me @StealthBravo
- Posts
- 32,492
- Thanks
- 44
- Thanked 5,326 Times in 3,113 Posts
Someone leaked the 3.1 jailbreak on the dev teams blog several hours ago. Wow that must be annoying to deal with those guys posting it every 30 minutes. Dev-Team Blog
Did you erase it angiepangie?
-
09-13-2009, 11:40 PM #16Custom Title
- Join Date
- Jun 2009
- Location
- The Golden State :)
- Posts
- 3,840
- Thanks
- 22
- Thanked 221 Times in 210 Posts
They did?! Where??
Perhaps Confucious got to it.. idk.I always feel sorry for the guy in the iPhone commercials. He always gets a call right in the middle of trying to do something
-
09-13-2009, 11:56 PM #17Now you have an accomplice to help you stir the pot? Originally Posted by StealthBravo
Someone leaked the 3.1 jailbreak on the dev teams blog several hours ago. Wow that must be annoying to deal with those guys posting it every 30 minutes. Dev-Team Blog
Did you erase it angiepangie?
I wish I would have thought of that !
I bet the dev teams blog is now getting blown up with even more hits than it already was.
-
09-14-2009, 12:00 AM #18Custom Title
- Join Date
- Jun 2009
- Location
- The Golden State :)
- Posts
- 3,840
- Thanks
- 22
- Thanked 221 Times in 210 Posts
I didn't see it.
Stealth was it on the main post or on an older one?I always feel sorry for the guy in the iPhone commercials. He always gets a call right in the middle of trying to do something
-
09-14-2009, 12:29 AM #19My iPhone is a Part of Me
- Join Date
- Dec 2008
- Location
- New Orleans, LA
- Posts
- 902
- Thanks
- 52
- Thanked 78 Times in 61 Posts
3GS - 3.0.1 Yep, it works.
And definitely not worth losing tethering or my jailbreak altogether.
Does this rag smell like chloroform to you?
If I helped you, be sure to press the Thanks! button over there ->
If I didn't, press it anyway.
-
09-14-2009, 12:31 AM #20Custom Title
- Join Date
- Jun 2009
- Location
- The Golden State :)
- Posts
- 3,840
- Thanks
- 22
- Thanked 221 Times in 210 Posts
OOOOOHHHHHHHH man... I just got you Stealth..
dammmmnnnnnn I was taking you seriously...
Never againn...
I always feel sorry for the guy in the iPhone commercials. He always gets a call right in the middle of trying to do something
Reply With Quote
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
