Google Discloses a zero-click Wi-Fi Exploit to Hack iPhone Devices

Google Project Zero has disclosed the details of an iOS exploit that allows an attacker to hack iPhones remotely over Wi-Fi and steal sensitive data, with no user interaction.

Researcher Ian Beer from the Google Project Zero team has revealed technical details of a critical “wormable” iOS bug that possibly allowed a remote attacker to obtain control over the device.

Analysis

“The vulnerability stems from a fairly trivial buffer overflow programming error in C++ code in the kernel parsing untrusted data, exposed to remote attackers”, wrote the expert.

The researcher demonstrated the exploit in a test environment composed of an iPhone 11 Pro, a Raspberry Pi, and two different Wi-Fi adaptors. Beer was able to remotely accomplish arbitrary kernel memory read and write and inject shellcode payloads into the kernel memory bypassing the victims’ defense.

 “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory” reads the security advisory published by Apple. “A double free issue was addressed with improved memory management.”

The flaw, tracked as CVE-2020-3843, is a double free issue that could be exploited makes it possible to access photos and other sensitive data, including email and private messages. Apple addressed the CVE-2020-3843 vulnerability with the release of a series of updates.

Testing

For testing, the expert generated 100 random contacts with four contact identifiers such as home and work email, home and work phone numbers.

The attacker targets the AirDrop BTLE framework to enable the AWDL interface by brute-forcing a contact’s hash value from the list of 100 contacts stored within the device. Then the attacker triggers the buffer overflow to gain access to the device and run a malicious code implant as root achieving full control on the mobile device.

The expert explained that it is not conscious of attacks in the wild exploiting this vulnerability, but he pointed out that exploit vendors seemed to take notice of these fixes.

“I have no evidence that these issues were exploited in the wild; I found them myself through manual reverse engineering. But we do know that exploit vendors seemed to take notice of these fixes” says the expert. 

Technical details about the  flaw

Researchers from security firm Synacktiv published technical details about the CVE-2020-27950 flaw explaining that it had been chained with two other flaws.

“On November 5th, Project Zero announced that Apple has patched in iOS 14.2 a full chain of vulnerabilities that were actively exploited in the wild, composed of 3 vulnerabilities: a userland RCE in FontParser as well as a memory leak (“memory initialization issue”) and a type confusion in the kernel.” reads the analysis published by Synacktiv.

The three vulnerabilities chained in the attack are:

• A memory corruption issue in the FontParser library that was exploited to achieve remote code execution
• A memory leak that granted a malicious application kernel privileges to run arbitrary code
• A type of confusion issue in the kernel.

Conclusion

The flaw was addressed by Apple in a series of security updates pushed as part of iOS 13.3.1, macOS Catalina 10.15.3, and watchOS 5.3.7 earlier this year. Apple pointed out that a huge majority of iOS users keep their devices up to date so far so that they should not be susceptible to attacks.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Also Read

Apple High Severity Bug Allows Attackers to Execute Arbitrary Code on iPhone, iPad, iPod

Apple Dropped A Plan Let iPhone Users Have Fully Encrypt Backups On Their Devices Including WhatsApp Chats