9 ms·
Exploiting the Wi-Fi Stack on Apple Devices
- willitpamp573 9y agoIs Apple mad about this?
- egwynn 9y agoI can’t imagine why they would be. If I were them I’d be happy to have such a comprehensive pentesting resource to test against.
- wyldfire 9y agoI suppose he means the disclosure and not the testing itself. > The vulnerabilities presented in this research are present in iOS up to (and including) version 10.3.3 (apart from #1, which was fixed in 10.3.3). This seems like it's old enough that Apple probably doesn't mind anymore.
- reducesuffering 9y agoProject Zero discloses the vulnerabilities to the affected 90 days before releasing to the public. It's probable that Apple was notified and patched this because of Project Zero. Once it's been patched or 90 days are up, then Project Zero discloses to the public.
- MBCook 9y agoThey mentioned it’s fixed in iOS 11 so all Apple has to do is tell people to update their devices (which they always push anyway). It’s not like there is no fix for it.
- alwillis 9y agoiOS 11 Installed on 25% of Devices One Week After Launch--https://www.macrumors.com/2017/09/26/ios-11-one-week-25-percent-adoption/ https://www.macrumors.com/2017/09/26/ios-11-one-week-25-perc...
- eisa01 9y agoA lot of corporate customers have still not approved iOS for upgrades, so it's actually a big issue
- chatmasta 9y agoSounds like the corporation's problem, willingly ignoring security updates.
- alsetmusic 9y ago> Sounds like the corporation's problem, willingly ignoring security updates. A properly vetted update requires both compatibility testing and security testing. It would be irresponsible to push an OS update without verifying that it will not damage productivity or bring down defenses.
- glhaynes 9y agoBusinesses that provide or allow iOS devices need to be ready when new OSes are released to the public, which can easily be done since Apple offers regularly-updated betas for months in advance. This is particularly important because even managed devices cannot be prevented from upgrading to new OSes unless all traffic is routed through controlled networks that block access to Apple update servers.
- ec109685 9y agoThey had an opportunity to test via the beta period.
- nl 9y agoA saw a great T-shirt the other day: Hackers don't care about your corporate policy.
- freedomben 9y agoExactly. Project zero consists of some of the best security experts in the world. They also strictly practice responsible disclosure. I can't imagine why anybody would be mad to get such a great review and test for free, from such a great team.
- Terretta 9y ago> More concretely, the Wi-Fi vulnerabilities presented in this research affect many devices in the Android ecosystem. For example, two of the vulnerabilities (#1, #2) affect most of Samsung’s flagship devices, including the Galaxy S8, Galaxy S7 Edge and Galaxy S7. Of the two, one vulnerability is also known to affect Google devices such as the Nexus 6P, and some models of Chromebooks. As for Apple’s ecosystem, while this research deals primarily with iPhones, other devices including Apple TV and iWatch are similarly affected ... > We’d also like to note that until hardware host isolation mechanisms are implemented across the Android ecosystem, every exploitable Wi-Fi firmware vulnerability directly results in complete host takeover. In our previous research we identified the lack of host isolation mechanisms on two of the most prominent SoC platforms; Qualcomm’s Snapdragon 810 and Samsung’s Exynos 8890. We are not aware of any advances in this regard, as of yet.
- ksec 9y ago>iWatch 1. It should be Apple Watch. 2. I thought the newest Apple Watch uses Apple's own W2 Chip instead of Broadcom.
- coleca 9y agoAt least Apple has a simple way to disable Wifi right from the control center. Oh wait, they removed that in iOS 11. Now clicking the Wifi icon doesn't actually turn off Wifi. I guess no one will ever find similar issues w/that release </sarcasm>
- runjake 9y agoYou should probably get the facts[1] from Apple, before parroting Internet knee-jerk hysteria. 1. https://support.apple.com/en-us/HT208086 https://support.apple.com/en-us/HT208086
- jordan314 9y agoThat article says exactly what coleca was saying?
- Spooky23 9y agoNot really. This controversy is similar to people complaining about the loss of PC power buttons in 1997. The previous behavior was turning off the radio, which is often not the intent of the user. They replaced it with turning off joining networks, which is more often user intent. With the proliferation of personal connected devices like smart watches and cars, and point to point WiFi services like airdrop, users often want or need to have the radio on to utilize those services. At the same time, users may not want to join WiFi networks due to poor performance (ie one-bar WiFi), ineligibility for use (I’m at a Hilton for a conference, but am not eligible for free WiFi because I’m not staying there), or some other reason. The previous behavior also duplicated the behavior of the “airplane mode” button in some scenarios. IMO the iOS 11 behavior adds value in most cases and has two easy workarounds (airplane mode or system preferences) for people who want the radio off.
- donohoe 9y agoGonna have to disagree. I want them off. That has always been my intent and those I’ve informally asked.
- amatecha 9y agoBefore anyone freaks out that their iPhone is about to get pwnd: > The vulnerabilities affecting Apple devices have been addressed in iOS 11.
- blacksmith_tb 9y agoAndroid users (depending on who updates their devices, and how often) should also be safe[1] 1: https://source.android.com/security/bulletin/2017-07-01#broadcom-components https://source.android.com/security/bulletin/2017-07-01#broa...
- pjmlp 9y agoBasically only those rich enough to buy Google devices every three years.
- sk0g 9y agoI have a Sony phone from 2015 and have that security update, not sure what you're talking about. 7.1.1 has been out for a while already.
- pjmlp 9y agoNot everyone has a bugdet to keep buying flagship expensive phones. I own a LG device, bought in January, stuck on Android 6. There are only 1.6% of people in the world that own an Android device with 7.1.1, consider yourself lucky.
- pjc50 9y agoI like my ZenFone 2 but it's stuck on 5.0 :(
- milankragujevic 9y agoI am so happy I bought a Galaxy J5 (6) that can be flashed with Lineage OS 7.1.2. It's a really good phone, and even better with LOS.
- saagarjha 9y ago> As for Apple’s ecosystem, while this research deals primarily with iPhones, other devices including Apple TV and iWatch are similarly affected by our findings. The "correct" name for it is Apple Watch, just FYI.
- sebleon 9y agoMeh, iWatch and iMessage are surefire ways to get people to think of the right product. Technically incorrect terms, but they'll get the message right.
- saagarjha 9y agoiMessage is a real thing–I'm not sure what you're getting at here.
- derefr 9y agoThe service is iMessage, but the client is "Messages" on both iOS and macOS. The client was previously called "iMessage", leading people to assume that the marque "iMessage" is no longer part of Apple's branding. But no; extensions you install inside Messages are still called "iMessage extensions", and so forth.
- anyfoo 9y agoYeah. I think it's perfectly correct to still refer to it to "iMessage". While the client anyone is using is likely just called "Messages", it specifically uses what is referred to as "iMessage", among other possible ways (e.g. SMS, or Jabber on macOS).
- comex 9y agoActually, both clients have been named “Messages” as long as they’ve supported iMessage. The iOS client has been “Messages” since iPhone OS 3.0; before that it was called “Text” and had “SMS” written inside the chat bubble in the icon. iMessage wasn’t introduced until iOS 5.0. The macOS client was originally “iChat”, then “iChat AV”, then “iChat” again; in this era it supported multiple protocols including AIM and Jabber. In OS X 10.8, the client was renamed to “Messages” and gained iMessage support in addition to the older protocols. Support for the older protocols was removed in the just-released macOS 10.13.
- new299 9y ago> In the next blog post, we’ll use our firmware debugger in order to continue our exploration of the Wi-Fi chip present on the iPhone 7. We’ll perform a deep dive into the firmware, discover multiple vulnerabilities and develop an over-the-air exploit for one of them, allowing us to gain full control over the Wi-Fi SoC. ahhh cliffhanger! Looking forward to the next post!
- wcdolphin 9y agoGoogle is using their security research as a marketing weapon against Apple. From the article itself, Android is arguably more vulnerable as measured by percent of users running a device whose OEM has not distributed an update.
- gh02t 9y agoAndroid was the target of the original post, this is more of a followup demonstrating that a similar attack works on Apple hardware too. https://googleprojectzero.blogspot.co.uk/2017/04/over-air-exploiting-broadcoms-wi-fi_4.html https://googleprojectzero.blogspot.co.uk/2017/04/over-air-ex...
- pjmlp 9y agoThe irony is that all Apple devices will get the updates, whereas the Android ones....
- steevdave 9y agoAnything iPhone 5 or lower will not - 10.3.3 fixed one of the issues, but 2 more exist. I do wish they would at least put out a 10.3.4 to fix the security issues, but I understand not putting the resources into a phone from 2012; I'm happy to at least have gotten 10.3.3 considering my Nexus 5 stopped getting updates last year and it was release in 2013.
- Fnoord 9y ago> but I understand not putting the resources into a phone from 2012 I don't, but I have more sympathy for a company who quit supporting a phone from 2012 than a hypothetic [1] company who quit supporting a phone from 2015. [1] Tho certainly a plethora examples would fit here.
- michh 9y agoIt also includes the 5c, which was launched in 2013. The 8 gig version of it was sold by Apple as the budget option until September of 2015, a mere two years ago. Some retailers still carry them to this day.
- burntrelish1273 9y agoThe iOS 11 leaving the Wi-Fi on but unassociated creates a privacy vulnerability because the chipset will broadcast all of it's known SSIDs. Plus, whatever vulnerabilities remain in the chipset. This is terrible. When Wi-Fi is "off" it should be off.
- ronnier 9y agoIt was a stupid move. I can’t believe that it’s not getting more heat and attention
- evgen 9y agoWhen wifi is on it will look for an AP just like everything else does, and when it is off it does not broadcast at all. How difficult is this for you to understand? If you are talking about the control center 'disconnect from current wifi' option, well, get over it. Being unassociated with an AP is NOT the same as being turned off, and it never has been.
- mmjaa 9y agoThe point is, when I want to turn Wifi off, and use the common UI to do so, it should be off - and not just "in a state where it won't associate with AP's" .. this is Apple treating their users like idiots and putting us all at risk as a result of it - and, you have to ask why they do this? The reason is so that they can still harvest data while you're not associated with the AP - covertly, even - so that their location accessory 'feature' gets more data points.. From Apple directly: "For the best experience on your iOS device, try to keep Wi-Fi and Bluetooth turned on." The reason is because Apple are using WiFi for purposes other than those of the average user - data harvesting.
- evgen 9y agoWTF is 'common UI' even supposed to mean in this context? Apple is not treating their users like idiots, they are doing what the users usually want when they flip wireless settings via the control center. This may differ than what you expect, but I am sure you will eventually get over it. The number of people who used the control center to flip wifi/bluetooth for privacy purposes is so vanishingly small as to be a null set, especially when compared to the number of people who simply use the toggle to disconnect from a mediocre wifi connection so that they can use cellular data instead.
- feelin_googley 9y ago"Lastly, we require complete control over all aspects of our Wi-Fi router." Perhaps this is something users of Apple's WiFi-only/Ethernet-deficient devices might want. He provides a useful hint on how to construct a router that allows complete control, utilizing a general purpose computer and two AR9271-driven USB WiFi adapters. AFAIK this driver is available for both Linux and BSD. "In my own lab setup, the role of the Wi-Fi router is fulfilled by my ThinkPad laptop, running Ubuntu 16.04. I've connected two SoftMAC TL-WN722N dongles, one for each interface (internal and external). The internal network's access-point is broadcast using hostapd, and the external interface connects to the internet using wpa_supplicant." "Note that it's imperative that the dongle used to broadcast the internal network's access-point is a SoftMAC device (and not FullMAC) -- this will ensure that the MLME and MAC layers are processed by the host's software (i.e., by the Linux Kernel and hostapd), allowing us to easily control the data transmitted over those layers."
- azinman2 9y agoSo this is off topic, but does anyone else hate that swiping left/right in blogger navigates to other blog articles? I don’t know often people use that for real — I’m almost always directly linked to just one article in particular. But what’s worse is that it’s so sensitive without enough visual confirmation and ability to stop it. I find it naturally happens while scrolling on my iPhone without any intention, and then I lose my place and have no idea where I ended up. Just feels like a gigantic amount of UX flaws for a purpose that’s likely rarely used.
- hdhzy 9y agoYes, it's the most annoying thing I've seen on the web since <marquee>. Scrolling long fragments of code always takes me to another page when I'm reading. Who thought it was a good idea?!
- iokanuon 9y agoThe worst anti-feature of it seems to be when you enable enable the Force zoom accessibility option. Trying to zoom on blogspot images always activates this useless feature.
- StavrosK 9y agoYeah, whenever that happens I just accept that I'm never getting back to the article and close the page. The author can pick a less shitty host.