175 lines
No EOL
8.9 KiB
Text
175 lines
No EOL
8.9 KiB
Text
Document Title:
|
||
===============
|
||
Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability
|
||
|
||
|
||
References (Source):
|
||
====================
|
||
http://www.vulnerability-lab.com/get_content.php?id=1105
|
||
|
||
Video: http://www.vulnerability-lab.com/get_content.php?id=1104
|
||
|
||
|
||
Release Date:
|
||
=============
|
||
2013-10-04
|
||
|
||
|
||
Vulnerability Laboratory ID (VL-ID):
|
||
====================================
|
||
1105
|
||
|
||
|
||
Common Vulnerability Scoring System:
|
||
====================================
|
||
6.1
|
||
|
||
|
||
Product & Service Introduction:
|
||
===============================
|
||
iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally unveiled in 2007
|
||
for the iPhone, it has been extended to support other Apple devices such as the iPod Touch (September 2007), iPad (January 2010),
|
||
iPad Mini (November 2012) and second-generation Apple TV (September 2010). Unlike Microsoft`s Windows Phone and Google`s Android,
|
||
Apple does not license iOS for installation on non-Apple hardware. As of August 2013, Apple`s App Store contained more than 900,000
|
||
iOS applications, 375,000 of which were optimised for iPad. These apps have collectively been downloaded more than 50 billion times.
|
||
It had a 21% share of the smartphone mobile operating system units shipped in the fourth quarter of 2012, behind only Google`s Android.
|
||
In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod Touch and the iPad).[8] At the half
|
||
of 2012, there were 410 million devices activated. According to the special media event held by Apple on September 12, 2012, 400 million
|
||
devices had been sold by June 2012.
|
||
|
||
The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements consist
|
||
of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch, all of which
|
||
have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal accelerometers are used
|
||
by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three dimensions (one
|
||
common result is switching from portrait to landscape mode. iOS is derived from OS X, with which it shares the Darwin foundation and
|
||
various application frameworks. iOS is Apple`s mobile version of the OS X operating system used on Apple computers.
|
||
|
||
Major versions of iOS are released annually. The current release, iOS 7, was released on September 18, 2013. In iOS, there are four
|
||
abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The current version of the
|
||
operating system (iOS 7.0.2), dedicates 1–1.5 GB of the device`s flash memory for the system partition, using roughly 800 MB of that
|
||
partition (varying by model) for iOS itself.
|
||
|
||
(Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )
|
||
|
||
|
||
Abstract Advisory Information:
|
||
==============================
|
||
The Vulnerability Laboratory Research Team discovered a local bypass vulnerability in the official Apple iOS v7.0.1 Mobile.
|
||
|
||
|
||
Vulnerability Disclosure Timeline:
|
||
==================================
|
||
2013-04-10: Public Disclosure (Vulnerability Laboratory)
|
||
|
||
|
||
Discovery Status:
|
||
=================
|
||
Published
|
||
|
||
|
||
Affected Product(s):
|
||
====================
|
||
Apple
|
||
Product: iOS 7.0.1
|
||
|
||
Apple
|
||
Product: iOS 7.0.2
|
||
|
||
|
||
Exploitation Technique:
|
||
=======================
|
||
Local
|
||
|
||
|
||
Severity Level:
|
||
===============
|
||
High
|
||
|
||
|
||
Technical Details & Description:
|
||
================================
|
||
A restricted screen bypass via design glitch is detected in the official Apple iOS v7.0.1 for Mobile Devices (iPad|iPhone).
|
||
The security vulnerability allows local attackers to bypass the display screen of the restricted sim locked mode.
|
||
|
||
The bypass vulnerability is located in the iOS v7.0.1/7.0.2 when the `sim locked` mode of an iphone mobile is activated.
|
||
Local attackers can redirect the sim locked display to the regular default mode by using a restricted calculator function in
|
||
combination with the shutdown and unlock button. As result the local attacker is able to glitch > jump into the regular locked
|
||
phone mode with calender + hyperlinks, camera and control center. The regular sim locked display is at the end usable like in
|
||
the regular mode without sim locked label in the screen.
|
||
|
||
The local sim lock screen display bypass vulnerability can be exploited by local attackers with physical device access and without
|
||
user interaction. Successful exploitation results in the bypass of the sim lock mode to the regular lock mode. In a earlier test (7.x)
|
||
we combined the earlier discovered issues to first unlock the sim display (locked sim card) and bypass the pass code to fully compromise.
|
||
|
||
|
||
Proof of Concept (PoC):
|
||
=======================
|
||
The local vulnerability can be exploited by local attackers with physical device access and without user interaction.
|
||
For demonstration or reproduce ...
|
||
|
||
Manual reproduce like in the iphone poc security video ...
|
||
|
||
1. Start your iPhone and ensure you have the iOS v7.0.1 installed
|
||
2. Activate the Sim Lock mode
|
||
3. Start the device new and you will see a black notification in the middle of the display (sim locked)
|
||
Note: Sometimes the message also comes up in the restricted mode with a grey message box in the middle of the display.
|
||
4. Open the calender, and scroll down to the two hyper links
|
||
5. Press the power button and wait 2 secounds in the last secound your press one of the two hyperlinks
|
||
6. You get redirected via hyperlink because of the restriction to the pass code sim lock
|
||
7. Press again 3 secound the power button and push at the end in the last secound the home button
|
||
8. Click cancel again in the shutdown menu but hold the home button
|
||
9. Open up the control center and go to the calculator. Now a message box appears automatically with the sim lock entry button or the ok cancel
|
||
10. Press 3 secounds the shutdown button and in the last secound you press the unlock or ok button and hold home
|
||
Note: The pass code module comes up but some milisecounds after it there is an automatic redirect to the earlier opened module (calculator)
|
||
11. Now the attacker only press one time 3 secounds the power button again and when its opened he press cancel and one time the home button
|
||
12. The locked screen disappears and the restricted screen display mode has been bypassed.
|
||
|
||
|
||
Video PoC: https://www.youtube.com/watch?v=6_e-hvglQdg
|
||
|
||
|
||
Solution - Fix & Patch:
|
||
=======================
|
||
7.0.3 ?!
|
||
|
||
|
||
Security Risk:
|
||
==============
|
||
The security risk of the local sim lock display screen bypass vulnerability is estimated as medium(+)|(-)high.
|
||
|
||
|
||
Credits & Authors:
|
||
==================
|
||
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]
|
||
|
||
|
||
Disclaimer & Information:
|
||
=========================
|
||
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,
|
||
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
|
||
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business
|
||
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some
|
||
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation
|
||
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases
|
||
or trade with fraud/stolen material.
|
||
|
||
Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com
|
||
Contact: admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com
|
||
Section: www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com
|
||
Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab
|
||
Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php
|
||
|
||
Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.
|
||
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other
|
||
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and
|
||
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),
|
||
modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.
|
||
|
||
Copyright © 2013 | Vulnerability Laboratory [Evolution Security]
|
||
|
||
|
||
|
||
--
|
||
VULNERABILITY LABORATORY RESEARCH TEAM
|
||
DOMAIN: www.vulnerability-lab.com
|
||
CONTACT: research@vulnerability-lab.com |