Reply to post: What about browsers?

What about browsers?

Chrome, Firefox and I believe Safari all use SQLite, but obviously don't permit filesystem access where the db is stored. But couple it with an exploit that allows filesystem access via the browser (we've seen a few of those over the years) or one that lets you store unconstrained data in the db, and this bug could be leveraged for full code execution in the browser as the user running it.

That's going to be a problem for the owner of a smartphone, and if you couple it with privilege escalation exploit, something we see regularly on smartphones, then you have a way to completely p0wn a smartphone if you can get them to surf to your web page. Not quite enough to get $1 million from Apple (requires no user interaction so you'd need yet another exploit where you could e.g. send them a link via iMessage and cause the phone to open it without the user doing anything) but it would be worrying nonetheless.

Rather than hackers taking over popular sites and defacing them, they could leave the site alone and have it p0wn phones. That would take the site owners longer to notice and correct, since defacement is pretty obvious.

Now granted what I'm talking about here depends on several other exploits since this SQLite exploit by itself doesn't do all that much, but chain exploits are what we really need to worry about especially for smartphones. Something like that will be the first widespread attack on smartphones that changes perceptions, like I.LOVE.YOU was for Windows. Maybe a month from now, maybe a year from now, maybe five years now, but someday hundreds of millions of people will have their phones p0wned within days of each other.