Saturday, December 2, 2023

Google Discloses a zero-click Wi-Fi Exploit to Hack iPhone Devices

Google Project Zero has disclosed the details of an iOS exploit that allows an attacker to hack iPhones remotely over Wi-Fi and steal sensitive data, with no user interaction.

Researcher Ian Beer from the Google Project Zero team has revealed technical details of a critical “wormable” iOS bug that possibly allowed a remote attacker to obtain control over the device.

Analysis

“The vulnerability stems from a fairly trivial buffer overflow programming error in C++ code in the kernel parsing untrusted data, exposed to remote attackers”, wrote the expert.

The researcher demonstrated the exploit in a test environment composed of an iPhone 11 Pro, a Raspberry Pi, and two different Wi-Fi adaptors. Beer was able to remotely accomplish arbitrary kernel memory read and write and inject shellcode payloads into the kernel memory bypassing the victims’ defense.

 “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory” reads the security advisory published by Apple. “A double free issue was addressed with improved memory management.”

The flaw, tracked as CVE-2020-3843, is a double free issue that could be exploited makes it possible to access photos and other sensitive data, including email and private messages. Apple addressed the CVE-2020-3843 vulnerability with the release of a series of updates.

Testing

For testing, the expert generated 100 random contacts with four contact identifiers such as home and work email, home and work phone numbers.

The attacker targets the AirDrop BTLE framework to enable the AWDL interface by brute-forcing a contact’s hash value from the list of 100 contacts stored within the device. Then the attacker triggers the buffer overflow to gain access to the device and run a malicious code implant as root achieving full control on the mobile device.

The expert explained that it is not conscious of attacks in the wild exploiting this vulnerability, but he pointed out that exploit vendors seemed to take notice of these fixes.

“I have no evidence that these issues were exploited in the wild; I found them myself through manual reverse engineering. But we do know that exploit vendors seemed to take notice of these fixes” says the expert. 

Technical details about the  flaw

Researchers from security firm Synacktiv published technical details about the CVE-2020-27950 flaw explaining that it had been chained with two other flaws.

“On November 5th, Project Zero announced that Apple has patched in iOS 14.2 a full chain of vulnerabilities that were actively exploited in the wild, composed of 3 vulnerabilities: a userland RCE in FontParser as well as a memory leak (“memory initialization issue”) and a type confusion in the kernel.” reads the analysis published by Synacktiv.

The three vulnerabilities chained in the attack are:

  • A memory corruption issue in the FontParser library that was exploited to achieve remote code execution
  •  A memory leak that granted a malicious application kernel privileges to run arbitrary code
  •  A type of confusion issue in the kernel.

Conclusion

The flaw was addressed by Apple in a series of security updates pushed as part of iOS 13.3.1macOS Catalina 10.15.3, and watchOS 5.3.7 earlier this year. Apple pointed out that a huge majority of iOS users keep their devices up to date so far so that they should not be susceptible to attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Apple High Severity Bug Allows Attackers to Execute Arbitrary Code on iPhone, iPad, iPod

Apple Dropped A Plan Let iPhone Users Have Fully Encrypt Backups On Their Devices Including WhatsApp Chats

Website

Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Booking.com Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles