Friday, March 29, 2024

Google Discloses a zero-click Wi-Fi Exploit to Hack iPhone Devices

Google Project Zero has disclosed the details of an iOS exploit that allows an attacker to hack iPhones remotely over Wi-Fi and steal sensitive data, with no user interaction.

Researcher Ian Beer from the Google Project Zero team has revealed technical details of a critical “wormable” iOS bug that possibly allowed a remote attacker to obtain control over the device.

Analysis

“The vulnerability stems from a fairly trivial buffer overflow programming error in C++ code in the kernel parsing untrusted data, exposed to remote attackers”, wrote the expert.

The researcher demonstrated the exploit in a test environment composed of an iPhone 11 Pro, a Raspberry Pi, and two different Wi-Fi adaptors. Beer was able to remotely accomplish arbitrary kernel memory read and write and inject shellcode payloads into the kernel memory bypassing the victims’ defense.

 “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory” reads the security advisory published by Apple. “A double free issue was addressed with improved memory management.”

The flaw, tracked as CVE-2020-3843, is a double free issue that could be exploited makes it possible to access photos and other sensitive data, including email and private messages. Apple addressed the CVE-2020-3843 vulnerability with the release of a series of updates.

Testing

For testing, the expert generated 100 random contacts with four contact identifiers such as home and work email, home and work phone numbers.

The attacker targets the AirDrop BTLE framework to enable the AWDL interface by brute-forcing a contact’s hash value from the list of 100 contacts stored within the device. Then the attacker triggers the buffer overflow to gain access to the device and run a malicious code implant as root achieving full control on the mobile device.

The expert explained that it is not conscious of attacks in the wild exploiting this vulnerability, but he pointed out that exploit vendors seemed to take notice of these fixes.

“I have no evidence that these issues were exploited in the wild; I found them myself through manual reverse engineering. But we do know that exploit vendors seemed to take notice of these fixes” says the expert. 

Technical details about the  flaw

Researchers from security firm Synacktiv published technical details about the CVE-2020-27950 flaw explaining that it had been chained with two other flaws.

“On November 5th, Project Zero announced that Apple has patched in iOS 14.2 a full chain of vulnerabilities that were actively exploited in the wild, composed of 3 vulnerabilities: a userland RCE in FontParser as well as a memory leak (“memory initialization issue”) and a type confusion in the kernel.” reads the analysis published by Synacktiv.

The three vulnerabilities chained in the attack are:

  • A memory corruption issue in the FontParser library that was exploited to achieve remote code execution
  •  A memory leak that granted a malicious application kernel privileges to run arbitrary code
  •  A type of confusion issue in the kernel.

Conclusion

The flaw was addressed by Apple in a series of security updates pushed as part of iOS 13.3.1macOS Catalina 10.15.3, and watchOS 5.3.7 earlier this year. Apple pointed out that a huge majority of iOS users keep their devices up to date so far so that they should not be susceptible to attacks.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Apple High Severity Bug Allows Attackers to Execute Arbitrary Code on iPhone, iPad, iPod

Apple Dropped A Plan Let iPhone Users Have Fully Encrypt Backups On Their Devices Including WhatsApp Chats

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles