Forbes reports that Charlie Miller, a "serial Mac hacker" and Accuvant security researcher, has found an exploit that allows a signed iOS app to phone home to a remote computer, which can than steal the user's photos, read contacts, make the phone play sounds or vibrate, and more. Miller has already created a proof-of concept app that demonstrates this malicious behavior, which was available on Apple's App Store until it was pulled earlier today.
Miller's sleeper app was called InstaStock and purported to be a benign stock ticker tracker. Though Apple pulled the app down pretty quickly as news of the exploit got out, screenshots and the short description of the app can still be seen at AppShopper. Miller was also promptly kicked out of the iOS developer program. He plans to demonstrate the exploit at the SysCan conference in Taiwan next week.
“Now you could have a program in the App Store like Angry Birds that can run new code on your phone that Apple never had a chance to check,” Miller said. “With this bug, you can’t be assured of anything you download from the App Store behaving nicely.”
Quite the scary thought, but expect Apple to patch this exploit very quickly. While the "walled garden" approach has served Apple - and other company's platforms - fairly well thus far, this latest news is a stark reminder that even the most well-guarded systems will still have holes waiting to be discovered.
Watch a video of the exploit in action below: