Just found a HUGE #security #hole w/ push & AIM. Someone got my sent messages and wrote back. DO NOT send confidential AIM msg to #iPhone

#iPhone #push #security #hole:my msg was received by an hacked iPhone w/ push service hack; msg seems to be broadcasted to all hacked phones

Take extreme caution when sending AIM msg to people w/ hacked iPhones. Push service broadcasts your msg to strangers. Pls RT

@martinhering there seems to be a brand new hack that reactivates push with the effect that received msg are broadcasted to strangers

Here’s a screenshot the random receiver of my msgs sent me back http://twitpic.com/b3bct I used iChat on a Mac #iPhone #push #security #hole

The problem seems a result from a hack to avoid Apple’s jailbroken/unlocked iPhone push blockade, so if you haven’t used any of this, keep sending your kinky messages to your mistress or master as usual. Otherwise, zip it. [Twitter via ]

The developer says the following:

According to technical documentation, every Push application has to request the unique token from the Apple’s APNS servers to identify the device it’s running on. Thanks to that token, APNS servers always know which device is yours. The token can be understood as an IP address — the server has to know where to send the notification and for which application. APNS can also change your token regularly for higher reliability, so it’s critical that the application requests the token again on every start (or when enabling the Push feature) to replace the old one if new token is forced by APNS.

On any unlocked iPhone, the application requesting the token is stuck. APNS does not provide any response at all and the application can either cancel the request completely by automatic timeout or let user wait with the proggress bar forever. Either way, the user will never receive any Push message, because APNS has not provided the token.

However, I have an unlocked iPhone here in Spain and the push notification works perfectly—for example, with AIM. The catch, however, may be that my JesusPhone is using the official Movistar network, not a different one.

Whatever is the case, can Apple legally block these push services to people running iPhones on non-official networks? Would they be interested in doing this on purpose—since unlocked iPhones is such a small percentage of units? Or maybe it’s just a technical glitch?

According to the developer, it doesn’t matter: They argue that Apple has all the right to block services for these users—since they don’t use the official carrier—even while it’s hurting its ratings. However, they are asking Apple to provide a way to inform users with unlocked phones about why they don’t get push services using third-party applications. [Powerybase via AppAdvice via 9to5]

The Dev Team says that the 3GS is vulnerable to the same “24Kpwn” bootrom exploit that plagues the iPod Touch 2G—an patchable, un-updatable route of access for jailbreakers. Additionally, they expect to be able to unlock the phone with the ultrasn0w tool, using familiar techniques.

What seems a little odd about this is that the 3GS would so susceptible to hacking, and in such way that had been identified months ago. The Touch 2G had additional protections that the iPhone 3G didn’t, and it was release just a few months after. The 3GS, however, was release well over six months after the Touch 2G and quite some time after its predecessors exploits had been publicly identified, but doesn’t appear to have substantially different protections.

There are two possibilities here: either the 3GS development and manufacturing schedule is longer and more rigid than the iPod Touch 2G’s (the Dev Team says its bootrom was “cut” in August of 2008, before the 24kpwn exploit was identified) or, more compellingly, Apple just doesn’t really care that much about jailbreaking anymore. I’ll assume the former, and quietly hope for the latter. [Dev Team—Thanks, Bhoumik and Eric!]

They’ve finally delivered: the Dev Team has released the Ultrasn0w full unlock for last-gen iPhones running firmware 3.0.

The instructions are nice and short:

1. Ensure you have upgraded to iPhone OS 3.0
2. Jailbreak your iPhone 3G using redsn0w or PwnageTool (this will also install Cydia/Icy)
3. Run Cydia or Icy
4. Please add the repo repo666.ultrasn0w.com to Cydia or icy
5. Search for ‘ultrasn0w’ in cydia or icy and install ultrasn0w
6. Reboot your iPhone 3G
7. T-Mobile USA users should disable 3G before using ultrasn0w
8. Enjoy

It bears repeating that this hack will not work on the iPhone 3GS, though it will work on 2G and 3G models. The Dev Team is obviously working on this, but they’re not giving any fresh indication as to when a fully compatible tool will come out. [Dev Team—Thanks, Alexandru, Stephen, and everyone else!]

On Tuesday evening they will do a live demo of the new yellowsn0w carrier unlock working on official 3.0 firmware, just before the big Apple release. Good news for any would-be unlockers with an iPhone 3G, though those going for the 3GS will have to wait a bit longer. [DevTeamBlog via TheModShop—Thanks, Dylan!]

Yellowsn0w, the Phone 3G unlock, runs as a small command line application that gets installed in any jailbroken iPhone 3G using Installer. It’s very easy to install:

• First, update your iPhone 3G to the latest iPhone OS provided by Apple using the latest iTunes.

• Then, use QuickPwn 2.2 to jailbreak and activate your iPhone 3G. If you have Mac OS X 10.5.6 installed, you should follow these instructions before doing it.

• Use Installer or Cydia to install yellowsn0w, which is completely free. Here are the addresses you have to use to add yellowsn0w to your installer application:

For Cydia enter: http://apt9.yellowsn0w.com/
For Installer enter: http://i.yellowsn0w.com/

• That’s it. There are some special SIM cards that give problems, but f you have a normal SIM card from any non-official carrier, you are fine.

BEWARE: This is a beta application–version 0.9.1– so install at your own risk–I’m installing, it, though. Since it’s a daemon which doesn’t alter anything permanently, it seems safe. Just proceed with caution and be warned. [IPhone Dev Team]

The new iPhone OS 2.0 software has been unlocked and jailbroken. It was released just hours ago and it has already been cracked by the iPhone Dev Team. The first one took a couple of months, but this one was actually unlocked before Apple released it to the public. And you have had the proof in front of you all morning.

If you were wondering how I was doing push email tests on iPhone OS 2.0 and Vodafone UK, this is the reason why. The code wizard commandos at the iPhone Dev Team have been working on this non-stop since the early days of beta testing. In fact, I had iPhone OS 2.0 running on my iPhone since last week. That was version 5A345, two below 5A347, but identical in functionality.

Now that the official iPhone OS 2.0 is out, the iPhone Dev Team will release their Pwnage tool for everyone to unlock and jailbreak their iPhones soon. [Correction: An iPhone Dev Team press agent has contacted us to say that the official release date has not been specified.] It may not be as interesting as before–since most countries now have the iPhone and it will be impossible to buy without doing a contract first–but people looking to install unsigned applications and buy pay-as-you-go cards while traveling–instead of roaming–will find it very useful.

And besides, we don’t get tired of seeing the Death Star exploding again and again. [iPhone Dev Team Portal]

$299 – 16GB iPhone w/contract
$36 – Activation
$175 – Early Termination Fee
$70 – One month of service

Total Price Using The Shady Method: $580

So…

8GB iPhone Canceled: $480
16GB iPhone Canceled: $580
8GB iPhone Unlocked from AT&T: $599
16GB iPhone Unlocked from AT&T: $699

Are we missing something?

Having an unlocked iPhone has always been a tradeoff–you can get some cool 3rd party apps but trying to install firmware updates is a huge pain in the arse. Still, the urge to rebel and personalise your phone the way you want is strong–and there will always be a large group of people who will hack their iPhone just because they can. So, the question is would you unlock a 3G iPhone even when there are good SDK apps to be had?

Gawker Media polls require Javascript; if you’re viewing this in an RSS reader, click through to view in your Javascript-enabled web browser.