Researchers at mobile security firm Skycure have discovered a dangerous bug in iOSthat can lead to a crash of the operating system and put iOS devices in a repetitive reboot cycle.
This bug makes iPhone and iPad devices vulnerable to denial-of-service (DoS) attacks and can only be exploited on devices connected to a specially configured Wi-Fi.
Skycure has limited the disclosure of technical details to a minimum, as it does not want to provide information about the exact method of the attack to aspiring hackers. The company is also already working with Apple, actively participating in the process of creating a patch to fix the vulnerability.
According to a Skycure blog post, the following conditions must be met for a successful attack:
Initially, the router that provides the malicious wifi-hotspot must be properly configured, by enabling special settings. Additionally, a specially configured SSL certificate is required, as well as a script to exploit the vulnerability that exists in iOS 8 and its applications.
“After our discovery, we rushed to create a script that exploits the vulnerability via the network interface. Since SSL is a best security practice and is applied almost in all applications on the Apple Store, the attack surface could be very large. We knew that any delay in fixing the vulnerability could have huge repercussions for the business: a coordinated denial of service (DoS) attack could lead to massive losses”, says the CEO of Skycure.
However, this type of attack can be easily mitigated simply by removing the respective iOS device out of range from the Wi‑Fi network that caused the attack. Additionally, users should connect only to trusted Wi‑Fi networks in order to be effectively protected from attacks of any kind.
