Jailbreak vs security

[sfryman]

Funny how Apple can take months to fix certain bugs, but less than 2 weeks to patch the jailbreakme exploit...

Anyways, I've read today that jailbroken phones are a HUGE security risk. Apparently by keeping iOS 4.0.1 (& my jailbreak) I am allowing, nay ENCOURAGING hackers to take over my phone, steal all my money, destroy my credit and kidnap my children:

http://www.msnbc.msn.com/id/38676412/ns/technology_and_science-wireless/
http://reviews.cnet.com/8301-13727_7-20013368-263.html?part=rss&subj=news&tag=2547-1_3-0-20

Are they full of it? Is everyone keeping the jailbreak or going w/ Apple's security update?

 

[Spineshank]

Theres a fix on Cydia for that. Or you can change the root login.

 

[Need4Speed]

mass hysteria!

People with a lack of common sense are a HUGE security risk. Don't even get me started on how many people don't change the default admin password on their "secured" routers ...

 

[HalfCrazy]

You can easy change your root login password. By using 'MobileTerminal' on your iphone and entering couple simple commands.

 

[KeypoX]

Whats funny is the JB community once again did what Apple could not. Patch security hole for older, no longer supported by apple, ya know those things that are more than 2 years old.

No need to update just install fix on cydia.

http://www.redmondpie.com/secure-yo...-exploit-without-updating-to-ios-4.0.2-3.2.2/

 

[mmntech]

The PDF exploit was nothing to laugh at. It's a pretty big security flaw. Consider that a lot of people are doing online banking from their phones now. Non-jailbroken phones were actually more at risk because of the way the iPhone handles downloading PDF files. There's already a patch on Cydia for jailbroken phones that prevents it from downloading a PDF without asking.

Of course Apple's fight with the homebrew community is silly, but they're not the first. Sony does it all the time with the PSP. The reason Apple does it (my theory) is to maintain the monopoly the iTunes Store has on the device. The jailbreakers will always find another way in. Plus it's legal now so Apple can't go after them for trying.

 

[Emulex]

the pdf exploit was not only ios devices...

 

[ViRGE]

Theres a fix on Cydia for that.

This. Saurik wrote a fix for jailbroken phones, so just go install that patch. Contrary to what F-Secure and other security firms think, a jailbroken device doesn't mean letting malware run roughshod through the device.

 

[TheStu]

the pdf exploit was not only ios devices...

My understanding was that it was an exploit in how Mobile Safari handled PDFs.

 

[ultimatebob]

This. Saurik wrote a fix for jailbroken phones, so just go install that patch. Contrary to what F-Secure and other security firms think, a jailbroken device doesn't mean letting malware run roughshod through the device.

I love that the patch for jailbroken phones is much smaller and faster to install than the official Apple patch

 

[Kmax82]

I love that the patch for jailbroken phones is much smaller and faster to install than the official Apple patch

Yea.. I really hate how they do updates for iOS.

 

[sfryman]

Whats funny is the JB community once again did what Apple could not. Patch security hole for older, no longer supported by apple, ya know those things that are more than 2 years old.

No need to update just install fix on cydia.

http://www.redmondpie.com/secure-yo...-exploit-without-updating-to-ios-4.0.2-3.2.2/

TYVM for that link. Should be a default on Cydia

 

[sfryman]

You can easy change your root login password. By using 'MobileTerminal' on your iphone and entering couple simple commands.

I've tried to do this but MobileTerminal exits immediately when I try to run.

*edit*
Seems MobileTerminal is not compatible w/ ios 4. You need to SSH into device & change pw from a desktop. Unless someone knows of an alternate iphone terminal?

 

[HalfCrazy]

I've tried to do this but MobileTerminal exits immediately when I try to run.

Which firmware are you currently using on your device? If you are using the 4.0 firmware on your iphone/ipod. There is a MobileTerminal for iOS4 which is in beta if I recall correct. Sounds like your using a version which is not supported for your firmware. Once you find the version that works for your firmware. You will be able to change the root password for your device.

I own a Ipod Touch 2G using the 4.0 firmware. I got MobileTerminal installed and it's working just fine for me.

 

[ViRGE]

I've tried to do this but MobileTerminal exits immediately when I try to run.

*edit*
Seems MobileTerminal is not compatible w/ ios 4. You need to SSH into device & change pw from a desktop. Unless someone knows of an alternate iphone terminal?

Unless you have SSH installed, don't worry about the password. The root password is meaningless without a shell program/SSH; the phone doesn't even have su/sudo unless you install it from Cydia.

I love that the patch for jailbroken phones is much smaller and faster to install than the official Apple patch

The real issue is that Apple doesn't issue patches for the OS. The only thing you can download is the entire OS, which continues to grow over time. When you update, the device has to clean out and replace the entire OS partition, which is why you need the whole image and why updating is so damn slow.