UDID causes security compromise? Tapulous products’ users in danger!
Jul/097
Revenge, indeed.
Thanks to the guys at iPod touch Fans and their post here!
People out there who have a Tapulous account, beware. If you don’t know what a Tapulous account is, basically it’s the profile generated from the UDID (unique device identifier) of your iPhone/iPod touch. Tapulous’ authorization system is COMPLETELY dependent on your UDID, as practically speaking, you’re the only one with the number. It’s called UNIQUE for a reason, right?
Apparently that can be abused, with the UDID Changer app from Cydia. What’s detrimental is that your Facebook and Twitter information is stored on Tapulous’ servers as well. Of course it’s encoded, but when a malicious user changes their UDID to yours, Facebook and Twitter account data is immediately stored into their iPod touches/iPhones.
So what does this mean? It means that people can now access your Twitter and Facebook accounts, as well as anything else they store in their servers. Applications produced by Tapulous are: Tap Tap Revenge (and all its variants), Twinkle, Fortune, Collage and FriendBook.
Your next question that comes into mind must be: “But how the *insert profanity here* can they get my UDID?” There are PLENTY of ways noted by iPod touch Fans, including, but not limited to:
- The malicious user may just ask you, and you may give it to them.
- The malicious user may give you screenshots for a fantastic application they are making and offer you a beta. Of course, they need your UDID for you to beta test.
- The malicious user may be someone you know that actually has access to your device.
- Installer applications, such as Installer and Cydia send requests to the server with the UDID in the request. The maicious user may set up a repo to collect UDIDs.
- Etc. There are so many ways, it’s ridiculous.
Tapulous is aware of the exploit and are working on a fix to it, but meanwhile, unless you want someone posting the unthinkable on whatever accounts compromised, delete your Tapulous account. Change your Facebook and Twitter password as well, if you’re the “better safe than sorry” type of person.
Welcome to the family, iPhone 3GS!
Jul/090
And the iPhone Dev Team has answered: redsn0w 0.8 now officially supports jailbreaking of the iPhone 3GS. saurik has also updated the MobileSubstrate and WinterBoard packages for use with the 3GS, according to the iPhone Dev Team’s post here. However, the same old warning applies to all 3GS users to obtain the iBEC and iBSS files. They are now looking for more holes to exploit considering 3.1 would probably have a fix, and that would mean (temporarily) bad news for soon-to-be owners of the 3GS. To quote the Dev Team, “For those of you without 3GS phones, it’s a race against the clock to use this particular hole. There’s nothing we can do about that, but we will always be looking for new holes.”
ultrasn0w 0.8 has also been released which will support the iPhone 3GS. However, it is crucial that you do not upgrade to anything beyond 3.0, including the 3.1 beta software. Quoth the Dev Team: “Apple has gotten very serious with the latest baseband — they’ve removed 180 (!) commands in an effort to cut down their exposure to holes. So please always stay away from stock Apple IPSWs and instead use our tools as we release them. These tools let you update your firmware without updating your baseband.”
And good news for those using Linux: redsn0w has also been released for you guys as well. (: Get your redsn0w while it’s, er, cold! And obtain ultrasn0w by adding repo666.ultrasnow.com to the list of repositories in Cydia.
No QuickPWN? No Problem! 3.0 Jailbreak for iPhone 3G
Jun/0913
UPDATE: Still awaiting a QuickPWN release? Maybe you got punked! Did QuickPWN.com Rip Off The Dev Team’s iPhone Jailbreak? Just some food for thought. On with the show…
Like many of you, I counted the days until Apple released OS 3.0. I knew the Dev Team had been churning out the jailbreaks for the beta versions of OS 3.0, so I was pretty confident it would be released quickly, but just to be safe I went and glanced at the QuickPWN blog. Yep. It’s out. All set.
Oops… Yeah, so I went ahead with the OS 3.0 update only to realize that in my excitement and haste I had misread the blog and there was no QuickPWN for OS 3.0 yet!!! This was disheartening, but I was sure it would be available any day. Well, to make a long story short, it isn’t out and it isn’t coming, atleast not from the Dev Team. Although QuickPWN’s blog says they will have something out soon, I can’t wait any longer… I’m going in to deep jailbreak withdrawals and need a fix ASAP! So, here’s the result of my digging around to figure out a solution…
Here’s the usual disclaimer… you could turn your iPhone inside out and upside down and maybe make it poop on itself. That said, you’ll probably be just fine if you follow these instructions. And if not, it’s highly probably that a restore in iTunes will fix your problem and get you back to normal. What fun would gadget cracking be if you couldn’t potentially brick you expensive high tech toys? THIS IS NOT FOR IPHONE 3GS! Only 3G. I will verify this on my girlfriends iPod Touch 2G later and let you know if I had to buy her a new one or not :P I don’t mean to make this sound so risky, it really isn’t, but I don’t want angry iPhone users pissed at me because something went awry.
Step 1 – Preliminary Work (read: boring stuff):
Go to this entry on the Dev Team’s blog and READ the entire post. Make sure you understand what they’re saying (okay, this basically more disclaimer). While your there download RedSn0w for your OS of choice (I am jailbreaking mine on a PC). As of right now I think everyone running OS 3.0 is using revision 7A341, but to make this article future proof I need to tell you how to check this on your iPhone to be sure. It is very important to use the correct firmware for the jailbreak! Don’t worry, it’s easy and doesn’t merit a sub-totorial. Just go to Settings > General > About. You will see the firmware version at the bottom of your screen, like so:
See it downthere at the bottom? That was simple enough.
Top 5 Applications for Jail-broken iPhones
Jun/096
You can also read this title as ‘Top 5 Excuses to Jailbreak Your iPhone’! :-)
This is the Quickpwn mascott. I guess it is a ninja pineapple... get it? pineAPPLE :P
Now, I have to do an obligatory disclaimer… you could damage your phone, void your warranty, and maybe even increase your risk of cancer if you jailbreak your iPhone! But as promised, here’s my top 5 list for all you crazy bastards that like living on the edge of life and death enough to jail-break! Haha. I hope you detect the sarcasm there. Jail-breaking has become very simple and fairly safe. I have jail broken my iPhone 4 or 5 times now using Quickpwn on two different PCs and once on a laptop with absolutely no problems at all. And if your wondering, all but one of those times I redid my iPhone it was simply to get a fresh start after accumulating a ton of junk. The one other time was because out of the blue one day I could not get Cydia* to download anything new. I racked my brain and finally just restored my phone and redid the jailbreak.