| |||||||||||||
What lessons can be learned from the iPhone worms?What lessons can be learned from the iPhone worms?Posted Nov 11, 2009 20:07 UTC (Wed) by sourcejedi (guest, #45153)Parent article: What lessons can be learned from the iPhone worms?
Good article. I am forced to agree that most of the questions you ask are valid. I have my own answers, but you give readers quite enough information to make up their own minds.
That said, I think the speculation on future attacks on un-broken iPhones, and Apples alledged responsibility for the security of jail-broken phones, is unfortunate FUD.
> other than the fact that the iPhone is an embedded system, why should it be measured by different standards
The reason here is that the iPhone doesn't use the root password for anything.
It's unfortunate, and yes, ideally they should have disabled it. Defense in depth is always a good thing. But unless they left a "sudo" binary (with suid root) lying around somewhere, I can't see how it has any real effect on the security of an un-broken iPhone.
> should PwnageTool, PurpleRa1n, and the other jailbreak utilities [change the root password] upon installation, either by automatically generating a new password or by prompting the user?
Yes, this should be a part of any process which enables remote root login on the iPhone.
If you can't make it safe automatically, don't distribute it. Definitions of safety may vary, but "enables remote root login using the default password" is not a good one :-).
> is there any substantial risk to changing the root password on the device
Probably yes. If you forget the new password, I assume it will be harder to regain control of your system. That's true of all systems, but the combination of an embedded system and vendor lockdown makes it rather more worrying than usual.
Here's one possible trick which might balance these issues:
DISCLAIMER: NOT TESTED AT ALL (AND DEFINITELY NOT ON AN IPHONE)
/etc/passwd
/etc/sshd/config
Login remotely using "admin". The system will call you "root". You should still be able to login locally using "root" and the default password.
DISCLAIMER: BASED ON YEARS-OLD MEMORIES OF A ONE-OFF HACK
(Log in to post comments)
What lessons can be learned from the iPhone worms? Posted Nov 11, 2009 20:54 UTC (Wed) by mosfet (guest, #45339) [Link]
> > should PwnageTool, PurpleRa1n, and the other jailbreak utilities [change the root password] upon installation, either by automatically generating a new password or by prompting the user?
> > Yes, this should be a part of any process which enables remote root login on the iPhone.
No Jailbreak Tool I know installs SSH by default. You have to download and install it afterwards.
> If you can't make it safe automatically, don't distribute it. Definitions of safety may vary, but "enables remote root login using the default password" is not a good one :-).
Indeed. The tool which installs SSH should check for the default password and ask for a new one. But IIRC it is only a .deb package without any frontend interaction.
Also I remember a warning about exactly this problem, when I played around with jailbreaks and ssh on the iPhone.
What lessons can be learned from the iPhone worms? Posted Nov 11, 2009 22:23 UTC (Wed) by sourcejedi (guest, #45153) [Link]
That's interesting. I thought PermitRootLogin was false by default, but I was wrong - both for upstream and the current Debian package. That makes it much more of a grey area.
|
|||||||||||||