iPhone Runs In Root?!

Telephony Armageddon?

1. Apple run ordinary user applications as SUID root – as effective UID 0. This is a total no-no and has been known and understood to be such for a long time. Cocoa programming guru Don Yacktman once delineated the various associated dangers: the input managers, the Services menu, and the relative ease with which the malfeasants can get in. SUID root Cocoa apps are so dangerous it’s not recommended to even use the keyboard in them: an input manager can usurp control and do anything and input managers always run in the context of the client process – which in such case is root. Meaning anything is possible – any amount propagation and destruction. Meaning anything can be hidden anywhere – and left lurking to come back at a prescribed date.

And meaning you lose control of your own computer / smartphone and it’s no longer yours. So it can start spreading malware, hang out in botnets, send out mail bombs with exploits – and even ready itself to self-destruct on the birthday of Steve Jobs.

Whoa!

This is serious business.

But I don’t think it’s going to last.

I’m not an OS expert, but my guess is Apple has initially done it this way For A Reason. I just don’t know what that reason is. Hacker-bait? Diagnostics for malfunctioning iPhones that are returned to stores (and then to Apple HQ)?

Whatever the reason, I don’t expect this situation to last very long. I expect a firmware update/upgrade from Apple sometime soon (4-6 weeks is my estimation). And I think all those who have currently been eagerly hacking the iPhone will be shocked to find that Root access has been all locked up and all of their discoveries to date have been just about for nothing.

Update:

There is neither a su nor a sudo meaning the system is built with presumably no need for privilege escalation. Meaning the iPhone user is presumably already running as root.

iPhone OS X System Architecture: A First Look

Comments are closed.

%d bloggers like this: