5 ms·

WiFiDemon – iOS WiFi RCE 0-Day Vuln, and a Zero-Click Vuln That Was Patched

51 points by tech234a 5y ago

trav4225 5y ago
This website is constantly shifting around with my browser... :-/
NavinF 5y ago
Neat. Maybe we'll get an iOS 14.6 jailbreak out of this. Can anyone read the decompiled code in the screenshot? It seems like it does this: x = stringWithFormat(const_string, attacker_string); y = stringWithFormat(const_string2, x); log(y); Is that really exploitable or am I reading it wrong?
- _kbh_ 5y ago
  it was patched in 14.4 it seems so, so looks like no 14.6 jailbreak out of this. It looks like it may be exploitable, but the exploitation mitigations on iOS likely make it difficult.
  - NavinF 5y ago
    They claim that there are 2 attacks: The "WiFiDemon 0-Click Attack" was fixed in 14.4 whereas the "WiFi 0Day Format Strings Attack" is still viable on 14.6 I guess nobody here knows Objective-C so I'll never know how the latter attack works ¯\_(ツ)_/¯
cesarb 5y ago
There's one question which must always be asked whenever a new remote code execution vulnerability like this one is found: Is it wormable? That is, could a worm use it as a vector for spreading? If I understood this article correctly, the answer in this case is probably YES. A worm could use this vulnerability to inject itself into a phone without any user intervention, and once there use the same vulnerability to attack other phones of the same model around it, recursively. Since the reach of a WiFi beacon is not short (it always uses the lowest speed, and IIRC can easily reach a hundred meters), on a dense metropolitan area with enough of the vulnerable device models, it could spread very quickly. In other words, this vulnerability is of the "patch immediately, and if you can't, completely disconnect the device until it's patched" kind. I don't know much about iOS, but if this were Android, just disabling WiFi (without disabling a couple of hard-to-find settings related to location) wouldn't be enough; airplane mode might be enough, but for this class of device, would severely limit its main functionality.
- irundebian 5y ago
  Why isn't it enough to disable WiFi?

51 points by tech234a 5y ago

This website is constantly shifting around with my browser... :-/

Neat. Maybe we'll get an iOS 14.6 jailbreak out of this. Can anyone read the decompiled code in the screenshot? It seems like it does this: x = stringWithFormat(const_string, attacker_string); y = stringWithFormat(const_string2, x); log(y); Is that really exploitable or am I reading it wrong?

_kbh_ 5y ago
it was patched in 14.4 it seems so, so looks like no 14.6 jailbreak out of this. It looks like it may be exploitable, but the exploitation mitigations on iOS likely make it difficult.
- NavinF 5y ago
  They claim that there are 2 attacks: The "WiFiDemon 0-Click Attack" was fixed in 14.4 whereas the "WiFi 0Day Format Strings Attack" is still viable on 14.6 I guess nobody here knows Objective-C so I'll never know how the latter attack works ¯\_(ツ)_/¯

cesarb 5y ago

There's one question which must always be asked whenever a new remote code execution vulnerability like this one is found: Is it wormable? That is, could a worm use it as a vector for spreading? If I understood this article correctly, the answer in this case is probably YES. A worm could use this vulnerability to inject itself into a phone without any user intervention, and once there use the same vulnerability to attack other phones of the same model around it, recursively. Since the reach of a WiFi beacon is not short (it always uses the lowest speed, and IIRC can easily reach a hundred meters), on a dense metropolitan area with enough of the vulnerable device models, it could spread very quickly. In other words, this vulnerability is of the "patch immediately, and if you can't, completely disconnect the device until it's patched" kind. I don't know much about iOS, but if this were Android, just disabling WiFi (without disabling a couple of hard-to-find settings related to location) wouldn't be enough; airplane mode might be enough, but for this class of device, would severely limit its main functionality.

irundebian 5y ago
Why isn't it enough to disable WiFi?