VDB-10458 · OSVDB 97533

Apple iOS 7.0 Lockscreen Multi-Tasking security check for standard

EntryeditHistoryDiffjsonxmlCTI
CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
3.9$0-$5k0.00

A vulnerability classified as problematic has been found in Apple iOS 7.0 (Smartphone Operating System). Affected is an unknown function of the component Lockscreen. The manipulation as part of a Multi-Tasking leads to a privilege escalation vulnerability. CWE is classifying the issue as CWE-358. This is going to have an impact on confidentiality, and integrity.

The weakness was presented 09/19/2013 by Jose Rodriguez as iOS 7 Bug Lets Anyone Bypass iPhone's Lockscreen To Hijack Photos, Email, Or Twitter as confirmed article (Website). The advisory is available at forbes.com. The vendor was not involved in the coordination of the public release. Local access is required to approach this attack. The exploitation doesn't require any form of authentication. Technical details are unknown but a public exploit is available. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 03/24/2019). It is expected to see the exploit prices for this product increasing in the near future.This vulnerability is assigned to T1211 by the MITRE ATT&CK project. This vulnerability has a historic impact due to its background and reception. The advisory points out:

As the video shows, anyone can exploit the bug by swiping up on the lockscreen to access the phone’s “control center,” and then opening the alarm clock. Holding the phone’s sleep button brings up the option to power it off with a swipe. Instead, the intruder can tap “cancel” and double click the home button to enter the phone’s multitasking screen. That offers access to its camera and stored photos, along with the ability to share those photos from the user’s accounts, essentially allowing anyone who grabs the phone to hijack the user’s email, Twitter, Facebook FB or Flickr account.

A public exploit has been developed by Jose Rodriguez and been published immediately after the advisory. It is declared as highly functional. The exploit is shared for download at forbes.com. As 0-day the estimated underground price was around $100k and more. Apple iOS contains a flaw that is triggered when swiping up on the lockscreen, which will allow access to the phone's 'control center' and allow access to the alarm clock. If the sleep button is subsequently held down, the power off option will come up. If the cancel button is pressed the attacker can double click the home button and gain access to the phone's multitasking screen, which grants access to the camera, stored photos, the ability to share photos from the user's account, and allow the hijacking of the user's email, twitter, facebook, and flickr accounts.

It is possible to mitigate the problem by applying the configuration setting Settings / Control Center / Access on Lock Screen / Off. The article contains the following remark:

A spokesperson from Apple tells me that the company “takes security very seriously and we’re aware of this issue. We’ll deliver a fix in a future software update.

Further details are available at forbes.com.

Productinfoedit

Type

Vendor

Name

CPE 2.3infoedit

CPE 2.2infoedit

Videoedit

CVSSv3infoedit

VulDB Meta Base Score: 4.0
VulDB Meta Temp Score: 3.9

VulDB Base Score: 4.0
VulDB Temp Score: 3.9
VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv2infoedit

AVACAuCIA
🔍🔍🔍🔍🔍🔍
🔍🔍🔍🔍🔍🔍
🔍🔍🔍🔍🔍🔍
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
unlockunlockunlockunlockunlockunlock
unlockunlockunlockunlockunlockunlock
unlockunlockunlockunlockunlockunlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

Exploitinginfoedit

Class: Privilege escalation
CWE: CWE-358
ATT&CK: T1211

Local: Yes
Remote: No

Availability: 🔍
Access: Public
Status: Highly functional
Author: Jose Rodriguez
Reliability: 🔍
Download: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-Dayunlockunlockunlockunlock
Todayunlockunlockunlockunlock

Threat Intelligenceinfoedit

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfoedit

Recommended: Config
Status: 🔍
Reliability: 🔍

0-Day Time: 🔍
Exploit Delay Time: 🔍

Config: Settings / Control Center / Access on Lock Screen / Off

Timelineinfoedit

09/19/2013 🔍
09/19/2013 +0 days 🔍
09/24/2013 +5 days 🔍
03/24/2019 +2007 days 🔍

Sourcesinfoedit

Vendor: https://www.apple.com/

Advisory: iOS 7 Bug Lets Anyone Bypass iPhone's Lockscreen To Hijack Photos, Email, Or Twitter
Researcher: Jose Rodriguez
Status: Confirmed
OSVDB: 97533

scip Labs: https://www.scip.ch/en/?labs.20150917
Misc.: 🔍

Entryinfoedit

Created: 09/24/2013 04:17 PM
Updated: 03/24/2019 03:33 PM
Changes: (2) software_type vulnerability_cwe
Complete: 🔍

Comments

No comments yet. Please log in to comment.

Might our Artificial Intelligence support you?

Check our Alexa App!