Apple is taking yet another major hit, after a revelation on how vulnerable actually is the iPhone's Mac OS, and now a shocking bug has been revealed.The man who found the bug is Piergiorgio Zambrini, the 38-year-old Italian systems engineer who created Ziphone, the first widespread application to unlocked iPhones. Zambrini explained the bug to Forbes.com (found via BGR), which then tested it and indeed proven:
"The bug Zambrini found is in the audio portion of Apple's video format. Knowing the bug exists, someone could write a program that incorporates the bug into a video file and trigger a crash whenever an iPhone attempts to run that file."
Forbes.com even has a video demo on how the bug works, click on this link to view it. "The fact that it's in a video file isn't really surprising to me," says Cameron Hotchkies, a reverse engineer and Apple expert at TippingPoint. "I'm actually surprised that it's crashing the device rather then crashing the Web browser because that means he's got a kernel vulnerability in the iPhone."
What is more panicking about this bug, is that it can also crash other Apple devices like the iPods & Macs! The bug, which is located in a shared code library that is used across most Apple operating systems and some Linux ones as well, doesn't appear to cause any permanent damage, but immediately sends the device into a panic that leads to a lengthy reboot.
Zambrini told Forbes.com that he spotted the bug in July, and sent an e-mail to Jobs explaining what he found. Zambrini says he hasn't yet contacted Apple's security response team. Forbes.com informed an Apple spokesman about the flaw and is still awaiting an official comment.
Zambrini planned to publish news about the bug Monday--although he's saving the technical details for Apple, he says--at least for now.
Even though Zambrini has made a fortune with his iPhone-unlocking software site; in his best day Ziphone can received more than $10,000 in donations, he says. And these days he charges advertisers $4,000 a month to display a banner ad. But then, Zambrini may change his mind because someone might be willing to pay for the bug technical details.
According to TippingPoint, a computer security company that pays for such vulnerabilities, an undisclosed flaw like the one Zambrini found can fetch a price on the open market from a few thousand to tens of thousands of dollars.
Sigh... Now I wish I shouldn't have skipped those computer programming classes, otherwise I could find bugs and sell 'em at expensive price to Steve Jobs. Yea, I wish! ~LOL~
[blogged with my Treo 750v]
No comments:
Post a Comment