Apple iOS 7.0 SIRI security check

Summaryinfo

A vulnerability classified as problematic was found in Apple iOS 7.0. Affected by this vulnerability is an unknown functionality of the component SIRI. Such manipulation leads to security check. Moreover, an exploit is present. Disabling the affected component is suggested.

Detailsinfo

A vulnerability was found in Apple iOS 7.0 (Smartphone Operating System) and classified as problematic. Affected by this issue is an unknown function of the component SIRI. The manipulation with an unknown input leads to a security check vulnerability. Using CWE to declare the problem leads to CWE-358. The product does not implement or incorrectly implements one or more security-relevant checks as specified by the design of a standardized algorithm, protocol, or technique. Impacted is confidentiality, and integrity.

The weakness was disclosed 09/20/2013 by Rahrikar and Yuen as Cenzic Researchers Uncover New Vulnerability in Apple’s iOS 7 that Enables Pretenders to Act on a Users’ Behalf – Even When iPhones are Locked as confirmed blog post (Website). The advisory is shared for download at blog.cenzic.com. The public release happened without coordination with the vendor. The attack needs to be approached locally. No form of authentication is required for exploitation. Technical details are unknown but a public exploit is available. The MITRE ATT&CK project declares the attack technique as T1211.

After immediately, there has been an exploit disclosed. The exploit is available at youtube.com. It is declared as proof-of-concept. As 0-day the estimated underground price was around $25k-$100k. The advisory illustrates:

The SIRI flaw can be used to operate many other iPhone functions that would normally require user permissions, even when the iPhone is locked. Among the operations that our researchers were able to accomplish on a locked iPhone include the ability to: - Call any phone - Send messages using iPhone owner’s identity - Send email using iPhone owner’s identity – This could enable phishing attacks - View calling history – Exposes information on recent calls and calling partners - View limited contacts – Enables attackers to discover details on specific, known contacts - Discover personal information of contacts with common, easily-guessed names - Post on Twitter - Post on Facebook - Get addresses saved in Apple Maps

The best possible mitigation is suggested to be disabling the affected component.

The vulnerability is also documented in the vulnerability database at OSVDB (97586†). darkreading.com is providing further details. The entry VDB-10473 is pretty similar. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Smartphone Operating System

Vendor

• Apple

Name

• iOS

Version

• 7.0

License

• commercial

Website

• Vendor: https://www.apple.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion