iOS Wi-Fi Exploit Could Have Let Hackers Remotely Access Nearby iPhones

[MacRumors]

Earlier this year, Apple patched an iOS vulnerability that potentially could have allowed hackers to remotely access a nearby iPhone and gain control of the entire device.

Devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research team, the exploit used a vulnerability in Apple Wireless Direct Link (AWDL), Apple's proprietary mesh networking protocol that enables features like AirDrop and Sidecar to work.

Beer revealed the stunning exploit on Tuesday in a 30,000-word blog post, which shows in detail how a memory corruption bug in AWDL could give attackers remote access to a user's personal data, including emails, photos, messages, and passwords and crypto keys stored in the keychain.

The vulnerability was discovered by Beer in a 2018 iOS beta that Apple accidentally shipped without stripping function name symbols from the kernelcache, offering a wealth of missing context about how bits of code fit together.

After lengthy investigative work, Beer was able to find code related to AWDL, identify the vulnerability, and target it remotely using a laptop, a Raspberry Pi 4B and a couple of Wi-Fi adapters.

It took six months for Beer to develop the exploit, but by the time he was finished he was able to hack any iPhone that was in radio proximity, run arbitrary code on it, and steal all the user data.

Beer says he has no evidence that the issues he uncovered were exploited in the wild, but "we do know that exploit vendors seem to take notice of these fixes."

The takeaway from this project should not be: no one will spend six months of their life just to hack my phone, I'm fine.

Instead, it should be: one person, working alone in their bedroom, was able to build a capability which would allow them to seriously compromise iPhone users they'd come into close contact with.

Imagine the sense of power an attacker with such a capability must feel. As we all pour more and more of our souls into these devices, an attacker can gain a treasure trove of information on an unsuspecting target.

Apple patched the vulnerability in May with the release of iOS 12.4.7 and iOS 13.3.1, and actually cites Beer in changelogs for several security updates. Apple said that the vast majority of users are already on newer versions of iOS that have been patched.

Article Link: iOS Wi-Fi Exploit Could Have Let Hackers Remotely Access Nearby iPhones

 

[haruhiko]

For the people who never updates their phones, please take note.

 

[farewelwilliams]

yet android ransomware goes on.

 

[max2]

For the people who never updates their phones, please take note.

Glad I always update.

 

[Mettwurst]

"Even faster on the new Apple M1 Macbook Air"

 

[SubduedTiger]

This is awesome.

 

[McScooby]

Since when is a MacBook just described as a generic laptop? My first thoughts after reading this was he used a PC!🤣

 

[0815]

At least 99% of the iPhone users can update to the latest version with all the critical fixes if they want. Most Android users have to get a new phone to get the latest OS updates.

 

[vionc]

That is really impressive. Kudos to Ian Beer!

 

[Farsider]

Yikes!

 

[max2]

I like when people get scared!

 

[locrumo]

iBeerphone

 

[kstotlani]

At least 99% of the iPhone users can update to the latest version with all the critical fixes if they want. Most Android users have to get a new phone to get the latest OS updates.

There was an interesting conversation between Joe Rogan and Snowden. Snowden mentioned that Android’s fragmentation makes it difficult for hackers because there are so many versions across thousands of different devices. It’s hard to concentrate and develop exploits for such variety. Hackers would rather concentrate on devices like iPhones where there is likelihood of more devices with the same version of the OS. Makes sense doesn’t it?

 

[gnasher729]

At least 99% of the iPhone users can update to the latest version with all the critical fixes if they want. Most Android users have to get a new phone to get the latest OS updates.

This was fixed in iOS 12.4.7. The latest iOS 12 version is iOS 12.4.9. It can be installed on an iPhone 5s, iPhone 6, and iPhone 6+. All later phones, starting with iPhone 6s, can run iOS 13 and iOS 14, which also fix the problem.

 

[miniyou64]

What is meant by “crypto keys”? That phrase is meaningless in this context or without context...

 

[max2]

I see what you did there.

 

[miniyou64]

For the people who never updates their phones, please take note.

What good is that? This is a cat and mouse game. You could be updating to a newer version with a different vulnerability. I doubt this exploit was possible in iOS 6...

 

[m.x]

This was fixed in iOS 12.4.7. The latest iOS 12 version is iOS 12.4.9. It can be installed on an iPhone 5s, iPhone 6, and iPhone 6+. All later phones, starting with iPhone 6s, can run iOS 13 and iOS 14, which also fix the problem.

Simply using iOS 13 does not fix the problem - he demonstrates the attack using an iPhone 11 Pro on iOS 13.2. You need iOS 13.3.1 as it was patched there. It‘s a bit nitpicky but this information is missing in the Macrumors article as someone might think „oh, I’m running iOS 13.1 so I’m not affected“.

 

[klunernet]

What good is that? This is a cat and mouse game. You could be updating to a newer version with a different vulnerability. I doubt this exploit was possible in iOS 6...

Sure. but who says it is as severe? Or more so? Or less? but at least you are not vulnerable for this one. (And this is a very nasty one).

and I am sure it does not work on ios6, if I recall correctly, that version did not have sidecar or handoff. Who knows how many security issues do still work on that one that where fixed already, though?

this is why mdm is a thing, companies do not want unpatched devices in their networks.

 

[DimitriMissinne]

One thing is for sure. This exploit could have brought us a whole new batch of nudes...

 

[gnasher729]

Simply using iOS 13 does not fix the problem - he demonstrates the attack using an iPhone 11 Pro on iOS 13.2. You need iOS 13.3.1 as it was patched there. It‘s a bit nitpicky but this information is missing in the Macrumors article as someone might think „oh, I’m running iOS 13.1 so I’m not affected“.

I remember early versions of iOS 13... My software checks if you are running on iOS 13.0 or iOS 13.1, adding a workaround for some serious bug. Yes, if you are say on iOS 14 today, you should install all iOS 14 updates. Then when iOS 15 is released some time in the future, probably wait a bit and install iOS 15.2.

 

[Sethal]

What is all the stuff on his laptop? Aside from the hard drive.

 

[max2]

What is all the stuff on his laptop? Aside from the hard drive.

Why you don't trust him ?

 

[apparatchik]

There was an interesting conversation between Joe Rogan and Snowden. Snowden mentioned that Android’s fragmentation makes it difficult for hackers because there are so many versions across thousands of different devices. It’s hard to concentrate and develop exploits for such variety. Hackers would rather concentrate on devices like iPhones where there is likelihood of more devices with the same version of the OS. Makes sense doesn’t it?

It does, a bit, but then again the target is always moving, by the time a hack is polished for, say, 13.1 most of the time a vast majority of the user base has moved on to the next version of the OS, requiring the user to simply let the phone update overnight to make it safe to the hack... then again, some hacks are hardware related in which context is easier to target Apple devices than the myriad of Android hardware combinations. Also, iOS users are more attractive targets as they are the upper scale of the market.

 

[max2]

Nothing can prevent hacking if someone wants to they will. (I know what people are going to think now)

No security is guaranteed or 100%.