Hackers at SecurityEvaluators.com are claiming that they’ve found a way to compromise the iPhone and created a proof-of-concept exploit capable of delivering files from the user’s iPhone to a remote attacker.

The exploit is delivered via a malicious web page opened in the Safari browser on the iPhone. There are several ways an attacker can get a victim to open such a web page:

• An attacker controlled wireless access point: Because the iPhone learns access points by name (SSID), if a user ever gets near an attacker-controlled access point with the same name (and encryption type) as an access point previously trusted by the user, the iPhone will automatically use the malicious access point. This allows the attacker to add the exploit to any web page browsed by the user by replacing the requested page with a page containing the exploit.
• A misconfigured forum website: If a web forum’s software is not configured to prevent users from including potentially dangerous data in their posts, an attacker could cause the exploit to run in any iPhone browser that viewed the thread. (This would require some slight changes in our proof of concept exploit, however.)
• A link delivered via e-mail or SMS: If an attacker can trick a user into opening a website that the attacker controls, the attacker can easily embed the exploit into the main page of the website.

When the iPhone’s version of Safari opens the malicious web page, arbitrary code embedded in the exploit is run with administrative priviledges.

The researchers have created a video that demonstrates the exploit:

They’ve notified Apple of the vulnerability and proposed a patch. Apple is currently looking into it.

via NYT