Biztonsági szakemberek állítják, új iPhone 0day támadást azonosítottak

Titkosítás, biztonság, privát szféra

TL;DR:

Exploitation timeline

We are aware of multiple attacks that happened starting from Jan 2018, on iOS 11.2.2. It is likely that the same threat operators are actively abusing these vulnerabilities presently. It is possible that the attacker(s) were using this vulnerability even earlier.

Affected versions:

  • All tested iOS versions are vulnerable including iOS 13.4.1. 
  • Based on our data, these bugs were actively triggered on iOS 11.2.2 and potentially earlier.
  • iOS 6 and above are vulnerable. iOS 6 was released in 2012! Versions prior to iOS 6 might be vulnerable too but we haven’t checked it.
  • The vulnerability allows remote code execution capabilities and enables an attacker to remotely infect a device by sending emails that consume significant amount of memory
  • The vulnerability does not necessarily require a large email – a regular email which is able to consume enough RAM would be sufficient. There are many ways to achieve such resource exhaustion including RTF, multi-part, and other methods
  • The heap overflow vulnerability is exploited in the wild
  • The vulnerability can be triggered before the entire email is downloaded, hence the email content won’t necessarily remain on the device
  • We are not dismissing the possibility that the attackers deleted any remaining emails following a successful attack
  • Attack on iOS 13: Unassisted (/zero-click) attacks on iOS 13 when Mail application is opened in the background
  • Attack on iOS 12: The attack requires a click on the email. The attack will be triggered before rendering the content. The user won’t notice anything anomalous in the email itself
  • Unassisted attacks on iOS 12 can be triggered (aka zero click) if the attacker controls the mail server
  • The vulnerabilities exist at least since iOS 6 – (issue date: September 2012) – when iPhone 5 was released
  • FAQ

Részletek technikai elemzés itt.

( noorbertt v | 2020. 04. 23., cs – 08:57 )

Az nagyon ciki, hol vannak az i fanok?

Valoszinuleg mindenki mast ert okoszisztema alatt, de en biztosan nem a hatulgombolos Mail.app-ot. Okoszisztema alatt en ilyesmiket ertek:

  • shared clipboard az eszkozok kozott (desktop, mobil, tablet)
  • kozos App Store, hordozhato licencekkel (mobil, tablet, ora, teve)
  • handoff (barhol)
  • jelszo helyett authentikacio unlockolt Watch-csal
  • stb.

A Mail.app azoknak jo, akik elvetve emaileznek csak. Ettol meg persze szopas a sokeves sechole, ezt nem vonja szerintem senki ketsegbe.

Miert lenne fura barmelyik email app? Irtam fentebb par peldat, egyik sem app-specifikus, pont ez lenne a lenyege (nalam) az okoszisztemanak. Asszem hetvegen copypaste-eltem az iOS Gmail appbol egy parancsot a macOS Terminalba. En az ilyenek miatt veszek elsosorban Apple cuccot, mert ezek az aprosagok baszakodas nelkul mennek. Meg azt is elhiszem, hogy mashol is van ilyen, de eddig csak olyat lattam, ami specifikus apphoz volt kotott, pl. desktop Chrome <--> mobil Chrome. 

( trey | 2020. 04. 23., cs – 09:14 )

Szerkesztve: 2020. 04. 23., cs – 09:15

Közérthetően:

Zero-Day Warning: It's Possible to Hack iPhones Just by Sending Emails

[...]

The default mailing app pre-installed on millions of iPhones and iPads has been found vulnerable to two critical flaws that attackers are exploiting in the wild, at least, from the last two years to spy on high-profile victims.

The flaws could eventually let remote hackers secretly take complete control over Apple devices just by sending an email to any targeted individual with his email account logged-in to the vulnerable app.

According to cybersecurity researchers at ZecOps, the bugs in question are remote code execution flaws that reside in the MIME library of Apple's mail app—first, due to an out-of-bounds write bug and second, is a heap overflow issue.

trey @ gépház