Security Researcher Posts iPhone Exploit Code Online

HD Moore, creator of the open-source Metasploit vulnerability testing tool, posted the code online and said it exploits a buffer overflow flaw in libtiff, the image rendering library that's used by the MobileMail, MobileSafari, and iTunes iPhone applications.

Moore first began to outline the security shortcomings of the iPhone in late September, when he wrote that any security flaw in any iPhone application can lead to a complete system compromise. Last week, Moore noted that only iPhones that had been unlocked were susceptible to the exploit code he'd been developing.

After Apple issued the 1.1.1 iPhone firmware update the next day, which re-locked unlocked iPhones by stripping away third party packages, Moore said the process of writing exploits for the device actually became much simpler.

"Fortunately for the iPhone development community, Apple shipped the iPhone with a vulnerable version of the libtiff library and didn't bother updating it for the 1.1.1 release," Moore wrote.

The flaw, which can be exploited through the MobileSafari Web browser, affects unmodified iPhones running the latest 1.1.1 firmware, as well as the iPod Touch device, according to a security bulletin issued last week by Secunia, which rated the severity of the threat as 'highly critical', or 4 on a 5 point scale.