Author: Melodie Foster
Date: 2nd December 2020
A white hat hacker disclosed details on Tuesday of a vulnerable “wormable” bug that could have allowed a remote attacker to gain complete control of any device nearby over Wi-Fi. This exploit has been patched and there have been no reports of it being exploited in the wild.
The hacker wrote of the flaw that it would have been possible to, “view all the photos, read all the email, copy all the private messages and monitor everything which happens on [the device] in real-time.”
The flaw was because of a “buffer overflow programming error,” in a Wi-Fi driver associated with Apple Wireless Direct Link. To be able to exploit the vulnerability, the hacker used an iPhone 11 Pro, Raspberry Pi and two Wi-Fi adapters which would allow for injection of “shellcode payloads into the kernel memory via a victim process, and escape the process’ sandbox protections to get hold of user data.”
The flaw had been patched several months ago in a series of security updates, namely iOS 13.3.1, macOS Catalina 10.15.3, and watchOS 5.3.7. Apple noted in its advisory that “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory,” and mentioned that the “memory corruption issue was addressed with improved input validation.”
Cyberfort Colocation Services
Cyberfort has invested heavily in secure infrastructure, making us the perfect colocation service provider to host your mission-critical, sensitive and regulated data.
Find out more >
Cyberfort Deep Dives
Cyberfort’s cybersecurity consultants explore issues in cyber threat intelligence, incident planning and data security. Read our whitepapers to help make decisions that benefit your business.
Find out more >