7 ms·
A specific network name can completely disable Wi-Fi on your iPhone
- perihelions 5y ago"The Wi-Fi subsystem probably passes the Wi-Fi network name (SSID) unsanitized to some internal library that is performing string formatting, which in turn causes an arbitrary memory write and buffer overflow. This will lead to memory corruption and the iOS watchdog will kill the process, hence effectively disabling Wi-Fi for the user." This sounds like a significant security bug?
- tinus_hn 5y agoIt’s pretty significant but a strong mitigating factor is that you have to join the network manually before this happens.
- OJFord 5y agoSurely more of a mitigating factor is that there's nothing to 'do' with it afterwards? It's easy to get people to (try to) join your WiFi network, but then what? Without some serious secondary effect I'd guess it's probably not getting desperately quick attention or a big payout.
- gpm 5y agoWith arbitrary memory writes, and an apparently reliable form of persistence across reboots, there's a pretty good chance there is something to do with it afterwards (RCE, leading to control of wherever this runs)... it sounds like that part just hasn't been figured out yet.
- swiley 5y agoFormat strings can do arbitrarily memory reads/writes so this will probably quickly turn into an RCE bug (it likely already has but we won't hear for another 90 days unless someone very based decides to tell us.)
- gruez 5y agoI get reads, but writes? How do you manage that? I'm presuming they're using the safe versions of sprintf but in case they're not, they probably have bigger problems.
- Gaelan 5y agoI think printf has a %n specifier that writes the number of characters so far to a pointer passed in.
- _kbh_ 5y agoThis was true maybe 10ish years ago ago but with ASLR, PAC, stack cookies and other mitigations it is now much harder to turn even a legitimate vulnerability (like a trivial buffer overflow) into actual RCE. Theres every likelihood that this isn't actually exploitable, on the other hand it might be, we will have to wait and see.
- deleted 5y ago[deleted]
- throayobviousl 5y agoSeems like an annoying DoS bug for sure. This is why having an actually secure watchdog is so nice. I still don't understand why people jailbreak in 2021.
- cable2600 5y agoSo they can sideload apps not approved by the Apple App store. A feature that Android phones have when developer mode is on.
- dawnerd 5y agoCan do that without a jailbreak though https://altstore.io/ https://altstore.io/
- webmobdev 5y agoYou have to trust them with your Apple ID (from the FAQº): Why do you need my Apple ID? Apple allows anyone with an Apple ID to install apps they’ve built themselves onto their devices for testing. AltStore uses your Apple ID to communicate with Apple's servers on your behalf and perform the necessary steps to prepare your account for installing apps onto your device. Do you save or send my Apple ID to anyone besides Apple? Your Apple ID is never sent to anyone but Apple. AltStore does save your Apple ID so it can refresh apps for you automatically, but it is stored securely in the device’s keychain. AltServer does not save your Apple ID, and requires you to enter your credentials each time. (Ofcourse, Jailbreak isn't necessarily more secure - you have no idea if they inject a malware into your device during the process.) º https://altstore.io/faq/ https://altstore.io/faq/
- eqvinox 5y agoearlier post: https://news.ycombinator.com/item?id=27560438 https://news.ycombinator.com/item?id=27560438
- bitwize 5y agoYet another reason why C was a mistake.
- m45t3r 5y agoParsing unstruted strings without escaping special characters is an issue in any language. This is completely Apple's fault.
- plantain 5y agoFunny how these faults keep happening over and over again in the same set of languages.
- m45t3r 5y agoI am pretty sure that I can have injection attacks from unsanatized user inputs in any language.
- melff 5y agoYes, but some languages (like my personal favorite Rust) make it practically impossible to happen with their equivalent of printf().
- dmitrygr 5y agoFunny how most car crashes are caused by humans driving.
- dylan604 5y agoWe've all been trained to sanitize user input, but the WiFi SSID isn't a user input string, so why should I need to sanitize it? --some poor dev wondering where their Twitterverse sympathy is
- m45t3r 5y agoYeah it is, I can definitely type my SSID in any device that I have.
- chasil 5y agoLittle Bobby printf. https://bobby-tables.com/ https://bobby-tables.com/
- iJohnDoe 5y agoThis could also be an intentional thing put into iOS to force an iPhone off Wi-Fi so it will connect to a Stingray device so traffic can be intercepted.
- lights0123 5y agoNo, because it requires you to have physical access to connect to it. If you have physical access, you could just turn off WiFi at that point. If you think that someone targeted would notice their WiFi turned off and turn it back on, they would definitely notice and probably become suspicious of that behavior shown in the video where WiFi automatically turns itself on and off rapidly.
- boomboomsubban 5y agoThey would need to know they're being targeted for them to be suspicious. Most people would see that happen and assume either a software bug or the screen had gotten wet. That said, I also find it unlikely this is a planned exploit.
- ronsor 5y agoIt's probably cheaper and easier just to jam the Wi-Fi bands than to try this trick.
- tyingq 5y ago"unless a load of Wi-Fi pranksters suddenly pop up in the wild with open Wi-Fi networks using the poisoned name" Heh. I do appreciate the subtlety here.
- gruez 5y agoLiterally the only thing stopping this from causing mass havoc is that most cafes are closed because of covid. If they were open you can cause quite a lot of grief by programming a bunch of esp8266 with this exploit and dropping them off at random cafes with a battery pack.
- atatatat 5y agolol "mass havoc" when we're dloading 80mbps over cellular connections...
- tyingq 5y agoIt seems to effectively brick your wifi in a way that survives power cycles, deleting the SSID, etc. The only thing that unbricks it is General -> Reset -> Reset Network Settings. So perhaps not havoc, but it would be pretty annoying.
- bigbizisverywyz 5y agoYes, good going - I think somebody just gave Woz a idea there ...
- w0mbat 5y agoIt’s such an obvious class of bug that any decent compiler complains if you do the equivalent of printf(theStr); rather than printf(“%s”, theStr); Still this bug regularly crops up all over the place, making the % character risky when naming any shared resource.
- pabs3 5y agoMost Linux/BSD distros compile their binaries with compiler hardening flags that mitigate this sort of issue, does Apple not use those flags?
- kwdc 5y agoStrong sense of dejavu. We used to send crash text messages to each other's iphones for fun. And the wifi has a vulnerability for names as well? Lessons will be repeated until they are learned.
- FreshFries 5y ago(Un-)fortunately, just photographing a QR code(0) with the mentioned SSID does not work ("Unable to join the network "%p%s%s%s%s%n"). Don't have a quick way to setup a WiFi with the specific SSID ATM. Would be interested to see if that works. 0: https://qifi.org https://qifi.org
- justinclift 5y agoDid you actually set up a WiFi network with that name first, for it to connect to though?
- gverrilla 5y agowhy are percentage symbols even allowed in wi-fi network names?
- gremlinsinc 5y agoI know what my new guest network will be called....