8 ms·
Tiny device is sending updated iPhones into a never-ending DoS loop
- greyface- 3y agoThe attack in question: https://github.com/Flipper-XFW/Xtreme-Firmware/blob/1a9c9cc32ff358f05a63b38348ba58fa225a3e9a/applications/external/ble_spam/protocols/continuity.c#L257 https://github.com/Flipper-XFW/Xtreme-Firmware/blob/1a9c9cc3...
- steve1977 3y ago… as long as the device can connect to the iPhone via Bluetooth. That’s still not good of course, but the headlines makes it sound like the phone is getting bricked, which is not the case.
- vasdae 3y agoCan you even disable bluetooth while the attack is going on?
- Cthulhu_ 3y agoYou can probably just turn your device off by long-pressing the off button though.
- vasdae 3y agoWhich is the same as having the phone bricked.
- steve1977 3y agoBricked for me means broken beyond repair, which is certainly not the case here. Basically, your best option would probably be to physically move away from the other devices, which considering the short range of Bluetooth should be doable in many cases. Provided you realize what's going on of course.
- vasdae 3y agoBricked used to mean that, but now it's certainly changed to mean "unusable"
- shmeeed 3y agoIt bothers me to no end that the meaning seems to have changed (I've recently noticed that as well, and I blame it mostly on a sloppy usage of the term for clickbait). I get it, non-tech-savvy people don't see the difference - but what are we supposed to call an actually bricked device now?
- chatmasta 3y agoIs a device ever really bricked? There's almost always some low level hackery you can perform to recover it or at least boot into an alternative firmware. And in the case of something like an encrypted boot partition with hardware-based cryptographic verification, if you get into a locked out state, it's just a matter of finding the right exploit before you can unbrick it...
- shmeeed 3y agoOf course most cases short of a severe hardware defect can be unbricked given the knowledge, time and means, that's not the question. I'm referring to the rising tendency on YT and social networks to call any software crash, DoS or whatnot a "brick" when it can be mitigated by simple user-level measures such as a reboot, or in this case, by turning off BT. IMO the term should be reserved for firmware faults or the levels below. Wikipedia gives a pretty good definition: https://en.m.wikipedia.org/wiki/Brick_(electronics) https://en.m.wikipedia.org/wiki/Brick_(electronics)
- steve1977 3y agoI don't think we should follow each and every dumbing down of society.
- panki27 3y agoI tried and crashed my iPhone with this. I locked the screen, and it never turned back on. Had to force a reboot for it to come back to live. So not "never ending" unless you stay within the Flippers BLE range, which is rather limited. Also, the notifications trigger on Windows aswell.
- Shank 3y agoEven if the device doesn’t crash, the inundation of these alerts is still a DoS and at times, very scary. You can generate them with various prompts, including some that prompt to transfer your phone number to a new device or setup a new iPhone. They’re disruptive and scary, and there needs to be a better protection system in-place against this.
- Cthulhu_ 3y agoYeah, I can imagine flood protection wasn't something the designers of Apple's bluetooth systems had in mind, but now this is out they're probably working on it.
- extraduder_ire 3y agoHas anyone ported this to the ESP32? I'd be a lot cheaper to get a bunch of those, versus one flipper zero.
- helsinkiandrew 3y agoIt seems to be a STM32WB55RGV6TR MCU (with integrated Bluetooth/Zigbee) and an LCD screen/buttons and a plastic case. At $200 that does seem expensive - you could get a real SDR that works with GNU radio for that. https://www.digikey.com/en/products/detail/stmicroelectronics/STM32WB55RGV6TR/10326860 https://www.digikey.com/en/products/detail/stmicroelectronic...
- Anonbrit 3y agoIt's also a sub-ghz radio, LF rfid, HF rfid, infrared and I-button, together with a GPIO connector that's seen a couple of interesting modules. More importantly, it has a community around it, with a few competing firmwares, so there are always new uses for it appearing.
- extraduder_ire 3y agoAll this exploit seems to need is bluetooth, which the esp32 has. It's also <$5 shipped. I would really like a flipper zero clone though.
- mo_42 3y agoIt's one thing that iPhones are prone to this attack. It's another thing that Apple confuses people with disabling Bluetooth. I always need to go to settings -> Bluetooth to really turn it off instead of using this pull-down menu. I assume many non-technical people don't understand this difference. So it seems like a violation of UX principles that only makes users feel to be in control.
- karlgkk 3y agoIt’s probably because they get a ton of tech support claims. Honestly, I appreciate the feature, I pretty much always want this stuff on.
- vladvasiliu 3y agoI actually think this is worse. If you want it on, leave it on. With this, they're in a weird state where they're not off, but they won't connect to anything, either.
- chatmasta 3y agoI don't know. If that were the case, why not support long-pressing bluetooth in control center to get the option to disable it completely?
- vladvasiliu 3y ago> I assume many non-technical people don't understand this difference. I hate as much as you do that I can't just turn off BT (nor WiFi!) from the pull-down menu. But at least on current iOS (17.1), when you "turn off" the BT a message pops saying "disconnecting BT devices until tomorrow"). Ditto for Wi-Fi. Also, when "disconnected", the icons don't look like the others when they are "off" (white background instead of dark gray). They actually look like other icons in the control center when they're turned on! Like the battery saver or flashlight. They also change to a different icon (barred BT symbol and fully dark) when you switch off BT in the settings. I'm pretty sure this has been the behavior for a while, since my older iPhone 7 had it too, and was stuck on iOS 15 IIRC.
- chatmasta 3y ago
- Freak_NL 3y agoGood job by the hacker on the train. The more people get used to the idea that their smartphone won't always work when they want it, the more they won't exclusively rely on it when there is a more significant risk. It's a one-man public service campaign.
- Cthulhu_ 3y ago> It's a one-man public service campaign. But it also makes them liable; messing with other people's tech like this can be construed as attempted hacking. What they were doing was NOT "white-hat hacking", that's the author who reproduced the attack in his own home on his own device.
- helsinkiandrew 3y agoYes - this is probably "Obstruction Of Telephone Or Telegraph Service" in most states.
- Freak_NL 3y agoFairly grey-hat I would think; the fact that they were doing this at a personal risk to themselves makes me appreciate it more.
- badcppdev 3y agoWell I'm glad you're certain that none of the passengers on the train were using their phone for critical patient care or handling a time sensitive family issue.
- Freak_NL 3y agoThe more reason to educate people on that front. Don't rely on your single piece of tech in your pocket to work all the time. Society ought to reacquire a bit of resilience on that front. Need to do critical patient care while commuting? Surely you will have made sure to bring a dumb phone with you as backup, if you are really that critical a resource (after all, your battery might be dead, someone might have stolen your fancy Iphone, etc.). Time sensitive family issue? What if you turned your phone off to read a book? Are you the asshole now? The train driver might have been stopped at a red signal in the Schipholtunnel; not much of a chance of getting a phone signal there. Is he now endangering people by depriving them of their umbilical uplink? What if the time sensitive family issue happened while you had your phone turned off for some intimate private time with your partner? How will you ever forgive yourself? The key takeaway here is to understand that there is no such thing as being available all the time. So don't expect it, and don't feel guilty about not providing it. There are all plenty more of those convoluted minimal chance scenarios you can come up with, but these hold true for anything people around you do.
- bell-cot 3y ago[sigh/] Apple's aura: Perfect security & privacy Apple's reality: Overall less-crappy security & privacy than its leading competitors For a premium brand seeking to maximize profit, this makes perfect business sense. And Tim Cook is pretty good at both the "business" and "profit maximizing" stuff.
- ethanbond 3y agoApple’s aura is not that they have perfect security & privacy, but that they give a fuck about security and privacy, and they don’t have a business model that’s entirely reliant on disrespecting or circumventing their users’ security and privacy.
- bell-cot 3y agoMany longer and more-specific terms apply to what you are describing. Hence my use of "aura", with its connotations of being ethereal / involuntary / uncontrolled. Worth noting: The business models for Apple's largest competitors should also motivate them to care greatly about security* and privacy*. *Excepting the obvious "private" root holes, for their own exclusive use.
- ChrisArchitect 3y agoPrevious discussion a few weeks ago: https://news.ycombinator.com/item?id=37919396 https://news.ycombinator.com/item?id=37919396
- qup 3y ago"Little tool" = Flipper zero > [the attacker was] using a Flipper Zero device with custom firmware to send a combination of Bluetooth low energy (BLE) alerts to nearby iPhone handsets running iOS 17. > If you have an iPhone running iOS 17, then the only reliable way to protect against the pop-ups and crash attack is by disabling Bluetooth.
- hnburnsy 3y agoMake sure to disable from Settings and not Control Center
- kstrauser 3y agoI've installed the "little tool" on my Flipper Zero and confirmed that it does, in fact, crash my iPhone. I know I'm preaching to the choir here on this site, but as a reminder, the tool only exposes a bug that was already there. It's an exploit for an existing problem. I'm glad that this bug is getting press now so maybe it'll get fixed. Without the public visibility, only the bad guys would have this ability. And as another reminder, an exploit that can reboot a device might be able to leverage that memory leak, null dereference, or whatever else to do more than just crash it.
- hulitu 3y ago> I'm glad that this bug is getting press now so maybe it'll get fixed. Of course it will get fixed. Apple fixes bugs _if_ the exploits are made public. /s
- cbzoiav 3y agoEven just crashing the device has significant impact. A bank robber, terrorist or totalitarian state could benefit significantly from bringing down all cell phones in the area for a few minutes (or even just crashing them in a loop as they boot up).
- kstrauser 3y agoGood point!
- user_7832 3y agoThat's a great incentive to fix such (bluetooth) vulnerabilities! Surely your message was because you're in favor for fixing such bugs urgently I hope?
- kstrauser 3y agoI think that's the only reasonable interpretation of their comment, that this is a serious problem that needs to be fixed.
- _lvbh 3y agoYou don’t need a Flipper Zero, just a Bluetooth chip.
- kstrauser 3y agoTrue, but I suspect the number of people who have a Flipper Zero and are able to install software on it is much greater than the number of people who could perform the exploit themselves starting with just a Bluetooth chip.
- amelius 3y ago> security researcher Jeroen van der Ham fell victim to the exploit on a train journey last month Holy crap ... this means that it probably happened to many other people too. Unless this was a train going to a security conference.
- neontomo 3y agoYeah this part sounds a bit set up for my taste. No context? How did he find out what device was used? Did he talk to the guy? More likely, he tested it on himself with a friend.
- stenioaraujo 3y agoThe post from Ars Technica [1] on the same subject has more details about the encounter. The researcher had it happen twice in two different trips, they were able to identify the person running the exploit because that was the person in common between both trips. This is very movie like in a sense still. [1] - https://arstechnica.com/security/2023/11/flipper-zero-gadget-that-doses-iphones-takes-once-esoteric-attacks-mainstream/ https://arstechnica.com/security/2023/11/flipper-zero-gadget...
- bastard_op 3y agoI feel it obligatory to bring my flipper and start crashing every iphone around me where ever I go. What can go wrong?
- kstrauser 3y agoI'm all for a bit of mischief, but please don't do this. I love using my little Flipper to hack my own stuff, clone RFID/NFC tags so I don't have to carry a bunch of access cards around, etc. I don't want it to get banned or classified as a criminal tool.
- deleted 3y ago[deleted]
- swamp40 3y agoI noticed last night our iPad can request Personal Hotspot access even when my iPhone Hotspot is off. There is 0 delay between pressing the hotspot button and my phone beeping. And you can do it as often as you like. It certainly doesn't go through the internet. I suspect it is direct ipad to iphone communication. I'm going to turn Bluetooth off tonight and see if it goes away.
- DANmode 3y agoFYI There are times when Bluetooth Off just means Bluetooth Pause, on iOS/iPadOS.
- HellsMaddy 3y agoYeah, if you use the Bluetooth toggle in control center, it doesn’t disable Bluetooth at all, it just temporarily disconnects all Bluetooth devices. If you go to your Bluetooth settings, it will still be enabled.
- ShadowBanThis01 3y agoYep, and this offensive disregard for the user's choices only impedes people from mitigating this attack. Tell Apple to PERMANENTLY respect the user's choices when turning BT and Wi-Fi on or off, no matter where they do it: https://www.apple.com/feedback/iphone/ https://www.apple.com/feedback/iphone/
- HumblyTossed 3y agoOr use an automation. Drop you a nice icon on the home screen and Bob's yer uncle.
- babypuncher 3y agoOr just don't do it because OP's reasons for leaving BT and WiFi off all the time are nonsense that haven't made sense in about a decade.
- cirrus3 3y ago> A similar attack can also be used on Android devices and Windows laptops. BleepingComputer reported last week that the Bluetooth spam attacks can be used on Samsung Galaxy phones to generate a never-ending amount of pop-ups.
- gnicholas 3y agoThis could be used as a way to get someone to type in their password (required on restart) in a visible environment where it can be captured by thieves. The thieves then steal/rob the phone from the person, and can access the phone, including sensitive banking apps. This allows thieves to steal a phone but get something much more valuable — thousands of dollars in bank transfers.
- kstrauser 3y agoYou can also use the tool's "Nearby Action Setup New iPhone" attack to pop up a "Set Up New iPhone" prompt showing the owner's Apple ID email address. I just tested this on my own phone, saw my own Apple ID, and screenshotted it for posterity.
- accrual 3y agoWhat do we think the fix is on the iOS 17? If it were me, knowing nothing about the inner details of iOS, I would apply some kind of rate limit or throttling on incoming BT connections and allow the user to ignore repeated incoming connections. It would be not unlike trying to download multiple files from the same website, which usually triggers a "do you want to allow $site to download multiple files?" prompt. Maybe I'm naïve, but this seems trivial to prevent.
- kevincox 3y agoYeah, it seems easy to fix. It is just that no one thought to do it yet. A rate-limit will turn a serious DoS (device crashes) to a very minor DoS (may struggle to pair a new device or get notifications from nearby devices).
- AlotOfReading 3y agoBluetooth stacks are a pretty rich source of bugs and security issues. Back when I was working at a consumer electronics manufacturer circa 2010, I documented nearly a dozen different crashes/bugs on Android and iOS devices caused by malformed packets my own buggy code was sending. Even simple things like getting the length of HID descriptors wrong would crash iOS at the time. I imagine they've fixed a lot of those with time and better tooling, and BLE is a much simpler standard to boot, but clearly there's still some gremlins lying around.
- camila45 3y agoI never anticipated to see Remotespywise reviews here, despite the fact that they once assisted me in hacking and spying on my husband's and kids' cell phones and devices, giving me access to all of their new and deleted messages as well as those from all of their social media platforms. remotespywise @ gmil com is very straightforward and upfront in their works, so it's wonderful that they receive all the recommendations like this, allowing many people who are searching for a very reputable and expert hacking business to learn about them . remotespywise @ gmil com is well-known for recovering digital assets from con artists and providing all kinds of hacking service