What's JailbreakMe? It's an easy way to jailbreak an Apple iOS device using a PDF (related) vulnerability.
It's done with a "drive-by" style exploit.
All somebody needs to jailbreak their (newer) iPad/iPhone/iPod is to visit jailbreakme.com and to touch the free/install button. The German Federal Office for Information Security has issued a warning about this. They're concerned about the potential for targeted malicious attacks using trojanized versions of the JailbreakMe exploit.
And that's certainly possible, in theory.
We've been asked: do we anticipate any attacks against iOS devices?
Targeted attacks? No, not really. It could happen, but we don't really anticipate any as such.
However, we wouldn't be at all surprised if some AntiSec hacker group attempted something "for the lulz".
And just how would somebody attack iOS devices? Via attachments?
Attachments? No. E-mail is so not the attack vector in this case (never was on an iOS device). What folks should be careful with are their social media apps, particularly Twitter.
A Twitter account belonging to Fox News was recently hacked and used to declare the death of Barack Obama. That hacked account could just have easily posted malicious links.
Heck, the links wouldn't even need to be malicious.
We can easily imagine AntiSec hackers tweeting links directly to jailbreak PDF files. When somebody clicks on such a link from their Twitter app, it would open Safari — as Apple doesn't allow for other default browsers — and then Safari would attempt to view the PDF. And then… jailbreak.
In the current AntiSec climate, the hackers might even claim that they're doing people a favor. After all, currently, the only PDF patch available is made for jailbroken devices.
You might want to be very careful what you click on between now and the time Apple releases iOS 4.3.4.
Here's a list of our JailbreakMe 2.0 posts from August 2010 (much of it is still relevant):
