The iPhone running OS 3 has a stupid usability feature. It seems like the iPhone is automatically opening a browser when joining a network. When joining a network, the iPhone tries to do the following:
\n1. DNS queries for www.apple.com
\n2. Opening http:\/\/www.apple.com\/library\/test\/success.html<\/p>\n
<\/p>\n
When both are successful, then fine… the phone gets back “success” and everything is ok.
\nWhen both are failing… that’s fine as well because then the phone assumes that the Internet connection is not up and running.<\/p>\n
If the phone can successfully query the name but get back any different content than “Success” it assumes that there is a captive portal which requires you to authenticate first to get access to the Internet. (Hotels, Hotspots etc)
\nIt seems like Apple was thinking.. damn that’s annoying for the user… lets open up
\nSafari automatically if this special case comes into place \ud83d\ude42
\nUsability kills security …. together with karmetasploit its a very evil thing. Get IPhone cookies, accounts and maybe even system control… depending on the bugs you have left to test.
\nYou can see the whole thing as a video @ vimeo
\nhttp:\/\/www.vimeo.com\/5466236<\/a> …. now lets find some new safari bugs<\/p>\n