{"id":4758,"date":"2010-08-03T08:54:07","date_gmt":"2010-08-03T16:54:07","guid":{"rendered":"http:\/\/www.labs.com\/research\/blog\/?p=4758"},"modified":"2025-06-04T02:24:25","modified_gmt":"2025-06-04T09:24:25","slug":"remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/","title":{"rendered":"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call"},"content":{"rendered":"

Like many iPhone users, I “jailbreak”<\/a> my iPhone. I do this for many reasons, but mainly for console-level access and the darn cool infosec tools that are available through Cydia.<\/a> Like many iPhone users, I was quite happy when the Electronic Frontier Foundation (EFF)<\/a> was able to get jailbreaking included under “fair use” within the Digital Millennium Copyright Act.<\/a> Like many iPhone users, I was also very <\/em><\/strong>happy to learn that Dev-Team<\/a> would soon make remote jailbreaking possible by simply visiting their jailbreakme website. Alas my happiness was not to last.<\/p>\n

While still at Defcon, I saw through Twitter that one exploit or another was being used to remotely jailbreak the iPhone. (I believe the first tweets I saw were from Brian Krebs.) I then saw posts from VUPEN that several flaws were being exploited. From their advisory:<\/p>\n

Technical Description<\/strong><\/h2>\n

Two vulnerabilities have been identified in Apple iOS for iPhone, iPad and iPod, which could be exploited by remote attackers to take complete control of a vulnerable device.<\/p>\n

The first issue is caused by a memory corruption error when processing Compact Font Format (CFF) data within a PDF document, which could be exploited by attackers to execute arbitrary code by tricking a user into visiting a specially crafted web page using Mobile Safari.<\/p>\n

The second vulnerability is caused by an error in the kernel, which could allow attackers to gain elevated privileges and bypass sandbox restrictions.<\/p>\n

Note: These flaws are currently being exploited by jailbreakme to remotely jailbreak Apple devices.<\/p>\n

Affected Products<\/p>\n

Apple iPhone OS (iOS) versions 4.x
\nApple iPhone OS (iOS) versions 3.x
\nApple iPod OS (iOS) versions 4.x
\nApple iPod OS (iOS) versions 3.x
\nApple iPad OS (iOS) versions 3.x<\/p>\n

Solution<\/p>\n

VUPEN Security is not aware of any vendor-supplied patch.<\/p>\n

References<\/p>\n

http:\/\/www.vupen.com\/english\/advisories\/2010\/1992<\/p>\n

Did you notice the line “VUPEN is not aware of any vendor-supplied patch”? In the security business we call those zero-day vulnerabilities. We call code that takes advantage of zero-day vulnerabilities zero-day exploits. (I have not seen confirmation from Apple that these are in fact zero-day vulnerabilities, so keep that in mind).<\/p>\n

I hope I am not the only one who is bothered by this because it begs the question “What else can this be used for?” Vulnerabilities with reliable exploit code tend to get reused and repurposed for other attacks\/malware\/uses. Just look at the .LNK vulnerability that Microsoft fixed yesterday via an out-of-band patch. It originally targeted power-plant control systems as the Stuxnet worm and then appeared in more mainstream malware because it was an unpatched vulnerability with working exploit code. Read this article in The Register<\/em> <\/a> for a real nice breakdown of it.<\/p>\n

This should serve as a wake-up call for anyone with a mobile device: Remote exploitation is real and here to stay. For now these vulnerabilities are being used only (as far as we know) to jailbreak iPhones, but they could be used to do many <\/em><\/strong>other things to iPhones and their owners around the world.<\/p>\n","protected":false},"excerpt":{"rendered":"

Like many iPhone users, I “jailbreak” my iPhone. I do this for many reasons, but mainly for console-level access and…<\/p>\n","protected":false},"author":695,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[],"coauthors":[787],"class_list":["post-4758","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs"],"acf":[],"yoast_head":"\nRemote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call | McAfee Blog<\/title>\n<meta name=\"description\" content=\"Like many iPhone users, I "jailbreak" my iPhone. I do this for many reasons, but mainly for console-level access and the darn cool infosec tools that are\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call | McAfee Blog\" \/>\n<meta property=\"og:description\" content=\"Like many iPhone users, I "jailbreak" my iPhone. I do this for many reasons, but mainly for console-level access and the darn cool infosec tools that are\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2010-08-03T16:54:07+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-04T09:24:25+00:00\" \/>\n<meta name=\"author\" content=\"McAfee Labs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee_Labs\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee Labs\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/\"},\"author\":{\"name\":\"McAfee Labs\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\"},\"headline\":\"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call\",\"datePublished\":\"2010-08-03T16:54:07+00:00\",\"dateModified\":\"2025-06-04T09:24:25+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/\"},\"wordCount\":512,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/\",\"name\":\"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call | McAfee Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"datePublished\":\"2010-08-03T16:54:07+00:00\",\"dateModified\":\"2025-06-04T09:24:25+00:00\",\"description\":\"Like many iPhone users, I \\\"jailbreak\\\" my iPhone. I do this for many reasons, but mainly for console-level access and the darn cool infosec tools that are\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad\",\"name\":\"McAfee Labs\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg\",\"caption\":\"McAfee Labs\"},\"description\":\"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.\",\"sameAs\":[\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee_Labs\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call | McAfee Blog","description":"Like many iPhone users, I \"jailbreak\" my iPhone. I do this for many reasons, but mainly for console-level access and the darn cool infosec tools that are","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call | McAfee Blog","og_description":"Like many iPhone users, I \"jailbreak\" my iPhone. I do this for many reasons, but mainly for console-level access and the darn cool infosec tools that are","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2010-08-03T16:54:07+00:00","article_modified_time":"2025-06-04T09:24:25+00:00","author":"McAfee Labs","twitter_card":"summary_large_image","twitter_creator":"@McAfee_Labs","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee Labs","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/"},"author":{"name":"McAfee Labs","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad"},"headline":"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call","datePublished":"2010-08-03T16:54:07+00:00","dateModified":"2025-06-04T09:24:25+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/"},"wordCount":512,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/","name":"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call | McAfee Blog","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"datePublished":"2010-08-03T16:54:07+00:00","dateModified":"2025-06-04T09:24:25+00:00","description":"Like many iPhone users, I \"jailbreak\" my iPhone. I do this for many reasons, but mainly for console-level access and the darn cool infosec tools that are","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/remote-iphone-jailbreak-using-pdf-exploit-should-serve-as-wake-up-call\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Remote iPhone Jailbreak Using PDF Exploit Should Serve as Wake-Up Call"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/86f325fa6532a017d06d6b49a2f3b1ad","name":"McAfee Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/af947d76ffbef8521094b476cf8050c3","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/07\/Social-Media-PF-Logo-Pic-300x300-2-96x96.jpg","caption":"McAfee Labs"},"description":"McAfee Labs is one of the leading sources for threat research, threat intelligence, and cybersecurity thought leadership. See our blog posts below for more information.","sameAs":["https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee_Labs"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee-labs\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/4758","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/695"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=4758"}],"version-history":[{"count":2,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/4758\/revisions"}],"predecessor-version":[{"id":215086,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/4758\/revisions\/215086"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=4758"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=4758"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=4758"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=4758"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}