A vulnerability classified as problematic has been found in Apple iOS 7.0 (Smartphone Operating System). Affected is an unknown function of the component Lockscreen. The manipulation as part of a Multi-Tasking leads to a security check vulnerability. CWE is classifying the issue as CWE-358. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique. This is going to have an impact on confidentiality, and integrity.

The weakness was presented 09/19/2013 by Jose Rodriguez as iOS 7 Bug Lets Anyone Bypass iPhone's Lockscreen To Hijack Photos, Email, Or Twitter as confirmed article (Website). The advisory is available at forbes.com. The vendor was not involved in the coordination of the public release. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/24/2019). It is expected to see the exploit prices for this product increasing in the near future.This vulnerability is assigned to T1211 by the MITRE ATT&CK project. This vulnerability has a historic impact due to its background and reception. The advisory points out:

As the video shows, anyone can exploit the bug by swiping up on the lockscreen to access the phone’s “control center,” and then opening the alarm clock. Holding the phone’s sleep button brings up the option to power it off with a swipe. Instead, the intruder can tap “cancel” and double click the home button to enter the phone’s multitasking screen. That offers access to its camera and stored photos, along with the ability to share those photos from the user’s accounts, essentially allowing anyone who grabs the phone to hijack the user’s email, Twitter, Facebook FB or Flickr account.

A public exploit has been developed by Jose Rodriguez and been published immediately after the advisory. The exploit is shared for download at forbes.com. It is declared as highly functional. As 0-day the estimated underground price was around $100k and more. Apple iOS contains a flaw that is triggered when swiping up on the lockscreen, which will allow access to the phone's 'control center' and allow access to the alarm clock. If the sleep button is subsequently held down, the power off option will come up. If the cancel button is pressed the attacker can double click the home button and gain access to the phone's multitasking screen, which grants access to the camera, stored photos, the ability to share photos from the user's account, and allow the hijacking of the user's email, twitter, facebook, and flickr accounts.

It is possible to mitigate the problem by applying the configuration setting Settings / Control Center / Access on Lock Screen / Off. The article contains the following remark:

A spokesperson from Apple tells me that the company “takes security very seriously and we’re aware of this issue. We’ll deliver a fix in a future software update.

Further details are available at forbes.com.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS

Version

• 7.0

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion