Tuesday, April 29, 2025
HomeCyber Security NewsWiFiDemon - iPhone Zero-click Wifi Hacking Flaw Can be Used to Execute...

WiFiDemon – iPhone Zero-click Wifi Hacking Flaw Can be Used to Execute Remote Code

Published on

SIEM as a Service

Follow Us on Google News

Recently the mobile security experts at zecOps have discovered a bug in the iPhone last month that intrudes wireless connectivity when it gets connected to an access point with a specific name.

This bug was dubbed as WiFiDemon, and it is a remote code execution vulnerability, and for implementing operation it does not require any kind of user intervention.

Wi-Fi-Demon

Wi-Fi is the key factor for the smartphone, and wifid is a daemon that manages protocol connected with a Wi-Fi connection and it operates as a root.

- Advertisement - Google News

According to the report, it says that wifid is a very delicate daemon that may guide the whole system to compromise. During the investigation, the security researcher, Carl Schou detected that wifid has an issue of format string while handling SSID.

The Bug Was Worse Than it Was Assumed

Before proceeding further, let me justify the above heading, in short, this flaw works even when the screen is off. There is a lot of things that have been found in this bug, and the cybersecurity researchers noted that the bug can be a trigger as a zero-click, and it also has the potential to execute remote code.

The security experts are trying to find another method for exploiting the vulnerability, as per the report, the analysts have used “%@,” which is a format specifier for distribution and formatting targets in Objective-C, which is the programming language for iOS software. 

Analysis of a Zero-Click WiFi Vulnerability

After investigating the whole matter, the analysts came to know that wifid has intriguing logs when it is not linked to any wifi. However, all these logs carry SSID, which intimates that they may be hit by the corresponding format string bug. 

The security analysts have tested and confirmed that it has been affected by the same format string bug, which implies that it is a zero-click vulnerability and can be activated without an end-user connecting to a newly named wifi.

Lastly, the researchers have also proposed that until and unless this bug is not getting fixed permanently, avoid joining to any public WiFi networks or any hotspots,  as doing so will help you to stay protected from this type of security flaw.

Necessities to the WiFiDemon 0-Click Attack

  • It needs the WiFi to be admissible with Auto-Join 
  • The vulnerable iOS Version is applicable for 0-click: Since iOS 14.0
  • The 0-Click vulnerability was reinforced on iOS 14.4

Mitigation:-

  • Initially update to the latest version, 14.6, as it bypasses the risk of WiFiDemon in its 0-click form. 
  • Always prefer disabling WiFi Auto-Join Feature through Settings –> WiFi –> Auto-Join Hotspot –> Never.
  • Conduct risk and trade-off assessment in your mobile/tablet security utilizing ZecOps Mobile EDR in case you infer that you have been targeted.

Necessities to the WiFi 0-Day Format Strings Attack

However, the WiFi format strings were seen to be a remote code execution, and while joining a malicious SSID the experts have noted it. 

Mitigation:-

  • Don’t get associate with unknown Wi-Fi networks.
  • Through Settings –> WiFi –> Auto-Join Hotspot –> Never try to disable the WiFi Auto-Join feature.
  • In case you assume that you have been targeted then quickly conduct risk and trade-off assessment to your mobile/tablet security.
  • The vulnerability is a 0-day, and the iOS 14.6 is vulnerable when correlating to a specifically crafted SSID. 
  • Lastly, wait for an authoritative update by Apple and implement it as soon as possible.
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

19 APT Hackers Target Asia-based Company Servers Using Exploited Vulnerabilities and Spear Phishing Email

The NSFOCUS Fuying Laboratory’s global threat hunting system identified 19 sophisticated Advanced Persistent Threat...

FBI Reports ₹1.38 Lakh Crore Loss in 2024, a 33% Surge from 2023

The FBI’s Internet Crime Complaint Center (IC3) has reported a record-breaking loss of $16.6...

Fog Ransomware Reveals Active Directory Exploitation Tools and Scripts

Cybersecurity researchers from The DFIR Report’s Threat Intel Group uncovered an open directory hosted...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

RansomHub Ransomware Deploys Malware to Breach Corporate Networks

The eSentire’s Threat Response Unit (TRU) in early March 2025, a sophisticated cyberattack leveraging...

19 APT Hackers Target Asia-based Company Servers Using Exploited Vulnerabilities and Spear Phishing Email

The NSFOCUS Fuying Laboratory’s global threat hunting system identified 19 sophisticated Advanced Persistent Threat...

FBI Reports ₹1.38 Lakh Crore Loss in 2024, a 33% Surge from 2023

The FBI’s Internet Crime Complaint Center (IC3) has reported a record-breaking loss of $16.6...