Tag Archive for: iOS

VULNERABILITY – NEW APPLE iOS 12 SCREEN BYPASS DISCOVERED

/by

It didn’t take long until a new lock screen flow was found for the new Apple’s iOS 12, released on 17 September 2018. Spanish researcher Jose Rodriguez published a YouTube video in Spanish language detailing the steps of the quite complex passcode bypass. An English-speaking version of the same video was subsequently published on YouTube.

According to the video, the attacker would need to exploit Siri, which would ave to be enabled, to access the phone’s contacts, numbers, emails and photos. It goes without saying that the Face ID functionality must be either inactivated or physically obfuscated. The process is not an easy one as it requires the offender to have physical access to the Apple device as well as a total of 37 steps to eventually gain access to the stored pictures.

This is the third time the same researcher exposed Apple’s security flaws. The latest bypass appears to work on all Apple devices running iOS 12 (and the iOS 12.1 beta), including the new XS.

Proficio Threat Intelligence Recommendations:

  • The bypass can be mitigated by disabling the Siri’s lock screen access via Settings > Face ID and Passcode or Settings > Touch ID and Passcode > disable “Allow access when locked”


General Information – Click Here

Vulnerability: Trustjacking

/by

A new iPhone vulnerability was disclosed at the RSA Conference in San Francisco. The vulnerability allows persistent control over an iPhone device without it being physically connected to a computer. With just a simple tap by the iOS device owner when connected to the same network as the attacker, the network link grants permanent control of the device without the owner even knowing the device has been compromised.This vulnerability exploits a weakness in an iOS function called iTunes Wi-Fi sync, a feature that allows users to sync up iTunes content and data between Apple devices wirelessly.

How it works:

  • User connects phone to a malicious charger/computer and chooses to trust it
  • Attacker allows the device to connect to iTunes and enables iTunes Wi-Fi sync (can be accomplished automated without user interaction)
  • The attacker remotely installs a developer image suitable to users iOS version over Wi-Fi

Attackers are then able to gain access to photos, install applications, remote backup as well as receive a livestream of the screen without needing any other confirmation from the user. After that initial “tap to trust” moment, the attacker does not require any more interaction with the user and all of the user’s vulnerable data is accessible remotely.

Proficio Threat Intelligence Recommendations:

  • Clear all “trusted” computers on iOS devices by resetting the location and privacy settings
  • Enable encrypted backup on your iOS devices

General Information – Click Here

Vulnerability: CVE-2018-0171 – Cisco IOS and IOS XE Software Smart Install – Remote Code Execution

/by

Cisco has disclosed a vulnerability in the Smart Install feature of the Cisco IOS Software and Cisco IOS XE Software.  This vulnerability could allow an unauthenticated, remote attacker to execute arbitrary code on affected switches as well as leverage this vulnerability to cause the devices to reload, which will result in a temporary DoS while the devices are reloading.

The vulnerability is due to improper validation of packet data resulting in a buffer overflow. An attacker could exploit this vulnerability by sending a crafted Smart Install message to an affected switch on TCP port 4786. Only Smart Install client switches are affected by the vulnerability. Smart Install client functionality is enabled by default on Cisco IOS switches on software releases that have not been updated to address the Cisco bug ID CSCvd36820.

Researchers said they had identified roughly 250,000 vulnerable Cisco devices with TCP port 4786 open. Sophisticated nation-state groups have previously exploited vulnerabilities in Smart Install in their campaigns targeting critical infrastructure. There has not been any evidence indicating that CVE-2018-0171 has been exploited in malicious attacks.

Cisco has responded by releasing software updates to fix this critical vulnerability for affected switches. Switches that are running releases earlier than Cisco IOS Software Release 12.2(52)SE are not capable of running Smart Install.

Proficio Threat Intelligence Recommendations:

  • Utilize the Cisco IOS Software Checker to determine if devices are vulnerable

Cisco IOS Software Checker – Click Here
General Information – Click Here