Apple has closed the signing window for iOS 8.1 on compatible iPhone, iPad and iPod touch models, thereby eliminating the ability for users to downgrade to the software version. iOS 8.1.1, seeded as an over-the-air update a few weeks ago, is now the earliest software version that devices can be restored to.
Expand
Expanding
Close
Security researcher Stefan Esser (via ArsTechnica) has discovered that an issue reported on Reddit as causing crashes on jailbroken iPhones and iPads is actually a piece of malware designed to capture Apple IDs and passwords from infected devices.
This malware appears to have Chinese origin and comes as a library called Unflod.dylib that hooks into all running processes of jailbroken iDevices and listens to outgoing SSL connections. From these connections it tries to steal the device’s Apple-ID and corresponding password and sends them in plaintext to servers with IP addresses in control of US hosting companies for apparently Chinese customers.
Early indications are that the source of the malware is likely to have been from a tweak downloaded from somewhere outside of Cydia. Esser has identified that the code only runs on 32-bit devices, meaning that the iPhone 5s, iPad Air and iPad mini with Retina display are safe, while other devices are vulnerable.
The blog post says that the malware is easy to check for, but may not be easy to remove. Using SSH/Terminal, check the path /Library/MobileSubstrate/DynamicLibraries/ for the presence of either Unflod.dylib or framework.dylib.
Currently the jailbreak community believes that deleting the Unflod.dylib/framework.dylib binary and changing the apple-id’s password afterwards is enough to recover from this attack. However it is still unknown how the dynamic library ends up on the device in the first place and therefore it is also unknown if it comes with additional malware gifts.
We therefore believe that the only safe way of removal is a full restore, which means the removal and loss of the jailbreak.
Cydia developer Jay Freeman, aka Saurik, pointed out on Reddit that adding random download URLs to Cydia is as risky as opening attachments received in spam emails.
A student at Goldsmiths, University of London has apparently been able to create an invisible, virtual keyboard for iPhones by using the device’s built-in accelerometer to pick up vibrations caused by tapping or typing on a surrounding surface area. As you can see from the video demonstration above, the “Virbrative” software developed by Florian Kraeutli (on a jailbroken iPhone 4) allows him to measure the strength and frequency of vibrations and then map them to iOS’ onscreen keyboard. The Telegraph spoke with Kraeutli about the software developed for a project on user interfaces:
“The signals I’m collecting are very weak,” said Florian Kraeutli, a computing student at Goldsmiths, who created the system as part of his work on user interfaces.“At the moment it’s more of a proof of concept but if you made the accelerometer more sensitive you could improve the accuracy quite easily.”
In the video above, we see the developer use a keyboard drawn on a piece of paper to train the system before tapping directly on the table underneath. Kraeutli noted users would ideally “train each key, but you can do just a couple.” According The Telegraph, the system “determines the intended key correctly about 80 per cent of the time, so the data is also fed into an auto correct dictionary to ensure the words are spelled correctly.” Kraeutli suggested that access to more powerful accelerometers could allow him to increase the accuracy of the system:
Expand
Expanding
Close