iOS 10.3 Fixes Exploit That Caused iPhones to Repeatedly Dial 911

[MacRumors]

iOS 10.3, released earlier this week, fixes a major vulnerability that could cause iPhones to repeatedly dial 911, reports The Wall Street Journal. In the United States, 911 is an emergency telephone number that summons police, fire, and EMS services.

The 911 security flaw surfaced in October after an 18-year-old iOS developer in Arizona discovered and published code that would cause an iPhone to dial 911 over and over again. The teenager was arrested after the 911 system in Surprise, Arizona was overwhelmed with more than 100 hang-up calls in just minutes.

Because the code was published online, thousands of accidental 911 calls were placed across the United States, demonstrating an effective cyberattack method that could severely disrupt emergency services.

The code exploited an iPhone feature that allows users to click on a phone number in a text message or on a webpage and immediately dial that number. With the iOS 10.3 update, iPhones always require secondary confirmation before automatically calling a number using that method.

Apple says the update supersedes that capability and now requires users to always press a second confirmation before initiating a call.

Apple says it initially worked with app developers to fix the vulnerability, and this update will now prevent it from happening even on apps that hadn't already fixed the issue.

iOS 10.3, which introduces features like Find My AirPods and a new Apple Filesystem, also includes dozens of major security fixes. Another major iOS 10.3 bug fix, which could result in endless Safari pop-ups that "locked" the Safari app, was outlined earlier this week.

Article Link: iOS 10.3 Fixes Exploit That Caused iPhones to Repeatedly Dial 911

 

[Act3]

"Because the code was published online, thousands of accidental 911 calls were placed across the United States, demonstrating an effective cyberattack method that could severely disrupt emergency services."

This came out in October and just now fixed. Either one heck of a exploit or a lack of a priority to fix. JMO.

 

[cicalinarrot]

I'd feel much more comfortable with a phone that explodes.
Well, if you have both an iPhone and a Galaxy Note 7, the iPhone can call the police for you when the Note explodes.

 

[thebanterboy]

I have had MAJOR issues with the music app after updating to 10.3. The app opens just fine, but when clicking on any of the tabs at the bottom, the entire phone crashes. I have downloaded Spotify as a result so that I can at least listen to some music. Can't listen to Apple Radio or my own music. I have soft reset the phone and restored from backup and nothing corrects this issue I am experiencing after updating to 10.3.

 

[thisisnotmyname]

The article is unclear, was he arrested for publishing the vulnerability or did he exploit it himself to DoS the 911 system?

 

[WRChris]

I have had MAJOR issues with the music app after updating to 10.3. The app opens just fine, but when clicking on any of the tabs at the bottom, the entire phone crashes. I have downloaded Spotify as a result so that I can at least listen to some music. Can't listen to Apple Radio or my own music. I have soft reset the phone and restored from backup and nothing corrects this issue I am experiencing after updating to 10.3.

Do a clean install then move your information back to the device. When you restore from a backup that has the problem, you may not fix the problem.

About the article, that dumb kid should be in jail. He knew what the code did and used it anyway. Throw the book at him and set an example.

 

[coolfactor]

It would be really nice if these articles could offer more accurate regional details. There seems to be a huge focus on the US, maybe because the publication is based out of the US? Remember that you are reaching a global audience.

Enhanced 911 is currently deployed in most metropolitan areas in the United States, Canada, and Mexico as well as all of the Cayman Islands. Also, Davao City in the Philippines.

Knowing that this 911 bug happened elsewhere, not just the US, broadens how many people and countries that it may have impacted.

 

[WRChris]

The article is unclear, was he arrested for publishing the vulnerability or did he exploit it himself to DoS the 911 system?

"The teenager was arrested after the 911 system in Surprise, Arizona was overwhelmed with more than 100 hang-up calls in just minutes." Just an assumption based on this information, but it sounds like this moron did this over 100 times in his own city.

Either way, fry his ass.

 

[sudo1996]

"The teenager was arrested after the 911 system in Surprise, Arizona was overwhelmed with more than 100 hang-up calls in just minutes." Just an assumption based on this information, but it sounds like this moron did this over 100 times in his own city.

Either way, fry his ass.

He published it online, and people clicked on it.
[doublepost=1490913809][/doublepost]I read about this a while ago; surprised it's only fixed now. To be clear, this vulnerability didn't just affect 911 calls. You could force the iPhone to make a call to any number. I couldn't find the technical explanation; I originally said it was with JS, but that was for the old iPhone OS 3 bug. Here's where I read about it first: https://9to5mac.com/2016/10/31/ios-exploit-911-call-centers/

 

[Macsterguy]

There was a very unfortunate case recently in the Dallas area where a child died when 911 couldn't be reached due to massive #'s of calls being made in to the system and it couldn't keep up. Hold times for 911 response were at times as much as 45 mim... Related?

 

[sudo1996]

There was a very unfortunate case recently in the Dallas area where a child died when 911 couldn't be reached due to massive #'s of calls being made in to the system and it couldn't keep up. Hold times for 911 response were at times as much as 45 mim... Related?

There's a vulnerability in Android systems that allows unprivileged apps to spoof the cellular ID that the phone uses to identify itself on the LTE network, plus Android lets those apps make phone calls. And there's a vulnerability in LTE systems where someone can spoof a bunch of random cell IDs with fake security keys that the carrier won't check IFF they're requesting a 911 call; in fact, that phone doesn't even need to be a subscriber to that carrier. And the 911 systems have no way of telling which calls are legitimate. So it could be that.

The worst part? Even if they fix this in Android,
1. Attackers can still get away with using their own devices, and any kind of fix for this on the LTE network would require phones to be updated so they can make legit 911 calls...
2. Nobody updates their Android phones.
[doublepost=1490914369][/doublepost]

It would be really nice if these articles could offer more accurate regional details. There seems to be a huge focus on the US, maybe because the publication is based out of the US? Remember that you are reaching a global audience.

Enhanced 911 is currently deployed in most metropolitan areas in the United States, Canada, and Mexico as well as all of the Cayman Islands. Also, Davao City in the Philippines.

Knowing that this 911 bug happened elsewhere, not just the US, broadens how many people and countries that it may have impacted.

The article should really say that this bug has nothing to do with 911 and is just an exploit to force the iPhone to call any number, regardless of your service provider.

 

[WRChris]

He published it online, and people clicked on it.

Thanks for clearing that up!

 

[now i see it]

So is it time to jump from 9.3.5 on an ip6 to 10.3 or not? There's no going back...

 

[Analog Kid]

I read about this a while ago. To be clear, this vulnerability didn't just affect 911 calls. You could force the iPhone to make a call to any number.

Nice. So he didn't have to attack critical emergency services, he just chose to do so?

"To show the seriousness" he aimed at 911. Basically, "let me hurt innocent people so you understand this could seriously hurt innocent people".

Thinking about the connection between actions and consequence is what jail is for, after all...

 

[l00pback]

It would be really nice if these articles could offer more accurate regional details.

Enhanced 911 is currently deployed in most metropolitan areas in the United States, Canada, and Mexico as well as all of the Cayman Islands. Also, Davao City in the Philippines.

This site is for news and rumors about Apple-related products and services. It's not Wikipedia.

 

[Analog Kid]

as all dropped calls to 911 have to be investigated – involving, at a minimum, calling back to check that the person who made the call is ok – the potential waste of police resources is substantial.

Smart enough to hack an iPhone with Javascript, but still too dumb to think through three lines of cause and effect in real life.

 

[CharlesS]

I bet getting that many calls caused that emergency department to be... surprised! (Ba-dum-chshh)

 

[WRChris]

I bet getting that many calls caused that emergency department to be... surprised! (Ba-dum-chshh)

Surprise Arizona, your emergency services are down.

 

[Exhale]

Smart enough to hack an iPhone with Javascript, but still too dumb to think through three lines of cause and effect in real life.

According to a WSJ I read a while back, apparently he found the method for the exploit in a YouTube video. In other words; a borrowed technique.

 

[Sefstah]

There's a vulnerability in Android systems that allows unprivileged apps to spoof the cellular ID that the phone uses to identify itself on the LTE network, plus Android lets those apps make phone calls. And there's a vulnerability in LTE systems where someone can spoof a bunch of random cell IDs with fake security keys that the carrier won't check IFF they're requesting a 911 call; in fact, that phone doesn't even need to be a subscriber to that carrier. And the 911 systems have no way of telling which calls are legitimate. So it could be that.

The worst part? Even if they fix this in Android,
1. Attackers can still get away with using their own devices, and any kind of fix for this on the LTE network would require phones to be updated so they can make legit 911 calls...
2. Nobody updates their Android phones.
[doublepost=1490914369][/doublepost]
The article should really say that this bug has nothing to do with 911 and is just an exploit to force the iPhone to call any number, regardless of your service provider.

Source for this alleged Android vulnerability? Nobody updates their Android phones? I call BS on this post.

 

[6foot5foot]

Kid needs a good slap and a large dose of wake up call.

 

[autrefois]

The code exploited an iPhone feature that allows users to click on a phone number in a text message or on a webpage and immediately dial that number. With the iOS 10.3 update, iPhones always require secondary confirmation before automatically calling a number using that method.

So it's now going to take longer to dial numbers — we can no longer do it automatically like before for legit purposes just because of this exploit? This is why we can't have nice things...

[EDIT to clarify]

 

[6foot5foot]

So it's now going to take longer to dial and will no longer do it automatically just because of this exploit? This is why we can't have nice things...

I'm not certain calling emergency services is a "nice thing" :/

 

[Pattaya]

So is it time to jump from 9.3.5 on an ip6 to 10.3 or not? There's no going back...

That's what I want to know too, my iPhone 6 is running fine on iOS 9.3.5, I doubt jumping to 10 will do anything but slow it down and create bugs, of course, I will be happy to be told otherwise.

 

[autrefois]

I'm not certain calling emergency services is a "nice thing" :/

I meant other numbers, not emergency ones. I totally agree that it was good to prevent emergency services from being overloaded, but it's annoying that the fix is to insert an extra dialog now that you always have to tap.