April 5, 2010 2:07PM  |
It was inevitable, but quick. Just one day after the iPad went on sale, a hacker called MuscleNerd jailbroke Apple’s newest device. While the iPad uses the same iPhone OS and Safari browser cracked at PWN2OWN, jailbreaking involves modifying the firmware. While iPad users can get more apps, they are also likely to forfeit Apple’s warranty.
 It took only one day after Apple made its iPad available for purchase for someone to jailbreak it. A hacker who lives in California and goes by the name of MuscleNerd posted a video on YouTube of him jailbreaking the iPad.Apple engineers may have rushed so much to get the highly anticipated device out the door and into the hands of consumers that they left behind a few unpatched security holes. In 15 hours on Saturday Apple sold 300,000 iPads, according to reports. But in less than 24 hours MuscleNerd took full advantage of those security holes to jailbreak the device. Jailbreaking allows iPad users to run any code on the device, versus only being able to use code authorized by Apple. In the past, hackers have been able to jailbreak other Apple devices, including the iPhone and iPod touch. Those with a jailbroken iPhone have been able to download many applications not available through Apple’s App Store using unofficial installers such as Cydia. The iPad runs on the same operating system as the iPhone and iPod touch, so with a jailbroken iPad, users will also have access to features without Apple-approved code. Requests to Apple for comment were not returned by deadline. Plugging Holes The jailbreaking of the iPad is no surprise, observers say. A jailbreak involves a persistent modification to the firmware on the device, according to Aaron Portnoy, security research team lead at TippingPoint and organizer of PWN2OWN, a hacking contest held each year at the CanSecWest security conference . “The iPhone and the iPad share the same code base for Safari,” Portnoy said. “Thus, vulnerabilities affecting the iPhone (like the PWN2OWN bugs) can likely be used to gain code execution inside the sandbox on the iPad.” What is surprising, however, is that Apple left behind some security holes in Safari last month when it patched up more than a dozen vulnerabilities. Apple did the patching after 16 holes were found in the browser during the PWN2OWN contest. But Portnoy said it may not have mattered. “Jaibreaking the iPhone or iPad … requires a firmware modification which can only be done during a power cycle,” Portnoy said. “Therefore, vulnerabilities affecting Safari are not able to jailbreak the device (at least no technique has been publicly disclosed to do so) because code is being executed in the sandbox.” In fact, the PWN2OWN Safari bugs were tested on the iPad, but organizers said they were not able to reproduce them. “This does not mean the device is invulnerable,” Portnoy added. “Just that it would require some development to get it working.” Getting Caught While it may be too soon for others to apply the jailbreak, MuscleNerd has taken the first steps to clearing a path for non-sanctioned applications to be installed on the iPad. MuscleNerd received an overwhelming amount of thank-yous from current and future iPad owners who were happy with the security breech. Jailbreaking the iPad comes with risk. Users with jailbroken iPhones and iPod touches have been able to use the App Store, but Apple has made it clear that all warranties on jailbroken devices are void. |
