Apple iOS v7.1.2 - Merge Apps Service Local Bypass Vulnerability
http://www.vulnerability-lab.com/get_content.php?id=1280
Video: http://www.vulnerability-lab.com/get_content.php?id=1281
Vulnerability Magazine: http://vulnerability-db.com/magazine/articles/2014/09/02/apple-ios-712-device-allows-local-attackers-merge-apps-ahead-pass-code-screen
2014-09-02
1280
5.9
iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally released in 2007 for
the iPhone and iPod Touch, it has been extended to support other Apple devices such as the iPad and Apple TV. Unlike Microsoft`s
Windows Phone (Windows CE) and Google`s Android, Apple does not license iOS for installation on non-Apple hardware. As of
September 12, 2012, Apple`s App Store contained more than 700,000 iOS applications, which have collectively been downloaded more
than 30 billion times. It had a 14.9% share of the smartphone mobile operating system units shipped in the third quarter of 2012,
behind only Google`s Android. In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod
Touch and the iPad). At the half of 2012, there were 410 million devices activated. According to the special media event held by
Apple on September 12, 2012, 400 million devices have been sold through June 2012.
The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements
consist of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch,
all of which have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal
accelerometers are used by some applications to respond to shaking the device (one common result is the undo command) or rotating
it in three dimensions (one common result is switching from portrait to landscape mode).
iOS is derived from OS X, with which it shares the Darwin foundation. iOS is Apple`s mobile version of the OS X operating system
used on Apple computers.
In iOS, there are four abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer.
The current version of the operating system (iOS 6.1) dedicates 1-1.5 GB of the device`s flash memory for the system partition,
using roughly 800 MB of that partition (varying by model) for iOS itself. iOS currently runs on iPhone, Apple TV, iPod Touch, and iPad.
( Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )
The Vulnerability Laboratory Research Team discovered a pass code (lock screen) bypass vulnerability in the Apple (iPhone) iOS v7.1.2 (11D257) mobile device system.
2014-07-15: Researcher Notification & Coordination (Benjamin Kunz Mejri - VL Core Research Team)
2014-07-16: Vendor Notification (Apple Security Team - Acknowledgement Program)
2014--: Vendor Response/Feedback (Apple Security Team - Acknowledgement Program)
2014--: Vendor Fix/Patch (Apple Security Team > Apple Developer Team)
2014-09-02: Public Disclosure (Vulnerability Laboratory)
Published
Apple
Product: iOS - Mobile Device System 7.1.2 (11D257)
Local
Medium
A local pass code (code lock) bypass has been discovered in the Apple (iPhone) iOS v7.1.2 (11D257) mobile device system.
The vulnerability allows to bypass via evade or glitch the local pass code service of iOS to compromise the mobile device.
The local bypass vulnerability is located in the pass code module of the Apple iOS v7.1.2. Local attackers with physical
access can merge local installed apps and default services via glitch ahead to the pass code module of the apple iphone device.
Regular the security policy of the device disallows to merge services ahead to the logon screen (pass code).
Local attackers without restricted physcial account can merge apps with functions ahead to the pass code module to compromise
the device. Local attackers with user account can prepare (manipulate) a mobile device to access later the restricted context.
During the tests we revealed that the exploitation is only possible (merge apps ahead to pass code) when the siri edit command
context has been involved to save temporarily context.
If the exploitaiton through the glitch was successful the attacker is able to prepare calls via app, write emails or access other
last used apps to compromise the iOS device.
The security risk of the local pass code bypass vulnerability is estimated as medium with a cvss (common vulnerability scoring
system) count of 5.9. Exploitation of the local glitch bypass vulnerability requires a privileged web-application user account,
multi user account or restricted physical device access without user interaction. Successful exploitation of the local pass code
bypass vulnerability results in device compromise or information leaking.
Affected Device(s):
[+] Apple > iPhone 5s
Affected OS Version(s):
[+] iOS v7.1.2 - 11D257
Tested Device(s):
[+] Apple iPhone 5s > iOS 11D257
The local pass code bypass vulnerability can be exploited by local attackers with privileged device user account without user interaction.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.
Manual steps to reproduce the issue …
Case Scenario:
During the security test we used the new iphone 5s of a lab member in our office to verify. We included the messages, face-time and
mail service in front on top of the iOS login mask. The local attacker is able to save through the evil glitch any program which is
available at the phone ahead to the login screen (pass code) module. At the end we made jokes by writing messages ahead to the
phone pass code (lock screen) module. The glitch has been reproduced when the watch of the login screen becomes visible in all
backgrounds of the used app. (watch video!)
Picture(s):
…/1.png
…/2.png
…/3.png
…/4.png
Resource(s):
…/poc-video.wmv
The security risk of the local glitch which allows to compromise the pass code is estimated as high(-).
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri ([email protected]) [www.vulnerability-lab.com]
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either
expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers
are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even
if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation
of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break
any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material.
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
Contact: [email protected] - [email protected] - [email protected]
Section: dev.vulnerability-db.com - forum.vulnerability-db.com - magazine.vulnerability-db.com
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
Programs: vulnerability-lab.com/submit.php - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
([email protected] or [email protected]) to get a permission.
Copyright © 2014 | Vulnerability Laboratory [Evolution Security]
– VULNERABILITY LABORATORY RESEARCH TEAM DOMAIN: www.vulnerability-lab.com CONTACT: [email protected]