Charlie Millers Discovers iOS Code Signing Security Flaw. Gets Kicked Out Of The Developer Program [video]

Charlie Miller, a former NSA analyst who now works as a researcher with consultancy Accuvant, created a proof-of-concept app called Instastock to show the vulnerability

Charlie Miller, a former NSA analyst who now works as a researcher with consultancy Accuvant, created a proof-of-concept app called Instastock to show the vulnerability. The simple program appears to merely list stock tickers, but also communicates with a server in Miller’s house in St. Louis, pulling down and executing whatever new commands he wants.

In the video above, he demonstrates it reading an iPhone’s files and making the phone vibrate. Miller applied for Instastock’s inclusion in the App Store and Apple approved the booby-trapped app.

Apple has pulled the app and terminated Miller’s developer license as a result of his research.

[via]



SUPPORT FSM

Monero (XMR) 43GnqUNJrTi9QyL7kEH8vM8pgWGCE6bjv1FSRipeNMM4TTeNnUVsRBb6MfMpQYxtLE7ReonxVVSXz2rFCEdW5H11LC3x73b
Bitcoin (BTC) 3PvaJPytg4pApTP5yCGpr62pRtudMgyfMQ
Ethereum (ETH) 0xd3c8677A4CfD9e8b4dFBb7720be2adb490Bd36b2