Google Hacker Details Zero-Click ‘Wormable’ Wi-Fi Exploit to Hack iPhones

Google Project Zero whitehat hacker Ian Beer on Tuesday
disclosed details of a now-patched critical “wormable” iOS bug that
could have made it possible for a remote attacker to gain complete
control of any device in the vicinity over Wi-Fi.

The exploit makes it possible to “view all the photos, read all
the email, copy all the private messages and monitor everything
which happens on [the device] in real-time,” said^[1]
Beer in a lengthy blog post detailing his six-month-long efforts
into building a proof-of-concept single-handedly.

The flaw (tracked as CVE-2020-9844^[2]) was addressed by Apple
in a series of security updates pushed as part of iOS 13.5^[3] and macOS Catalina
10.15.5^[4] in May earlier this
year.

“A remote attacker may be able to cause unexpected system
termination or corrupt kernel memory,” the iPhone maker noted in
its advisory, adding the “double free issue was addressed with
improved memory management.”

The vulnerability stems from a “fairly trivial buffer overflow
programming error” in a Wi-Fi driver associated with Apple Wireless
Direct Link (AWDL^[5]), a proprietary mesh
networking protocol developed by Apple for use in AirDrop, AirPlay,
among others, enabling easier communications between Apple
devices.

In a nutshell, the zero-click exploit uses a setup consisting of
an iPhone 11 Pro, Raspberry Pi, and two different Wi-Fi adaptors to
achieve arbitrary kernel memory read and write remotely, leveraging
it to inject shellcode payloads into the kernel memory via a victim
process, and escape the process’ sandbox protections to get hold of
user data.

Put differently, the attacker targets the AirDrop BTLE framework
to enable the AWDL interface^[6] by brute-forcing a
contact’s hash value from a list of 100 randomly generated contacts
stored in the phone, then exploits the AWDL buffer overflow to gain
access to the device and run an implant as root, giving the
malicious party full control over the user’s personal data,
including emails, photos, messages, iCloud data, and more.

Although there’s no evidence that the vulnerability was
exploited in the wild, the researcher noted that “exploit vendors
seemed to take notice of these fixes.”

This is not the first time security flaws have been uncovered in
Apple’s AWDL protocol. Last July, researchers from the Technical
University of Darmstadt, Germany, revealed vulnerabilities^[7] in AWDL that enabled
attackers to track users, crash devices, and even intercept files
transferred between devices via man-in-the-middle (MitM)
attacks.

Synacktiv Details Patched Apple “Memory Leak” Zero-Day

That’s not all. In a separate development, Synacktiv shared more
details about CVE-2020-27950^[8], one of the three actively exploited flaws^[9] that were patched by
Apple last month following a report from Google Project Zero.

While the disclosures were short on details, the vulnerabilities
were the result of a memory corruption issue in the FontParser
library that allowed for remote code execution, a memory leak that
granted a malicious application kernel privileges to run arbitrary
code, and a type confusion in the kernel.

By comparing the two kernel binaries associated with iOS 12.4.8
and 12.4.9, Synacktiv researchers were able to backtrace the roots
of the memory leak problem, explicitly noting that the changes
address how the kernel handles mach messages^[10] associated with
inter-process communication in Apple devices.

The researchers also devised a proof-of-concept code^[11] exploiting the flaw to
reliably leak a mach port kernel address.

“It’s quite surprising how long this vulnerability has survived
in XNU knowing that the code is open source and heavily audited by
hundreds of hackers,” Synacktiv’s Fabien Perigaud said.