Apple iOS 10.0/10.0.1/10.0.2 iTunes Backup 信息公开

CVSS 元临时分数	当前攻击价格 (≈)	CTI兴趣分数
4.8	$0-$5k	0.00

摘要信息

分类为棘手的漏洞曾在Apple iOS 10.0/10.0.1/10.0.2中发现。受影响的是未知函数，组件iTunes Backup。当被操控时，会导致信息公开。而且，有现成的漏洞利用。

分类为棘手的漏洞曾在Apple iOS 10.0/10.0.1/10.0.2中发现。受影响的是未知函数，组件iTunes Backup。当被操控时，会导致信息公开。利用 CWE 标识该问题会跳转到 CWE-307。此漏洞的脆弱性 2016-09-23由公示人Oleg Afonin、公示人所属公司Elcomsoft、公示人身份iOS 10: Security Weakness Discovered, Backup Passwords Much Easier to Break、公示人类型为Blog Post (网站)所公布。阅读公告的网址是blog.elcomsoft.com。此公开发布未经过与厂商的协调。

未提供技术细节。该漏洞的普及率高于一般水平。而且，有现成的漏洞利用。该漏洞利用已公开，攻击者可能会加以利用。当前漏洞利用的价值为美元大约是$0-$5k 。该漏洞由MITRE ATT&CK项目分配为T1110.001。安全公告说明：

When working on an iOS 10 update for Elcomsoft Phone Breaker, we discovered an alternative password verification mechanism added to iOS 10 backups. We looked into it, and found out that the new mechanism skips certain security checks, allowing us to try passwords approximately 2500 times faster compared to the old mechanism used in iOS 9 and older.

若有长度，则其被标记为高功能性。该漏洞利用程序可在elcomsoft.com下载。我们估计的零日攻击价值约为$25k-$100k。安全公告说明：

At this time, we have an early implementation featuring CPU-only recovery. The new security check is approximately 2,500 times weaker compared to the old one that was used in iOS 9 backups. (…) Elcomsoft Phone Breaker 6.10 is immediately available with 6 million passwords per second (CPU only) for iOS 10 backups. You are welcome to update right away. Further research is required to build an optimized GPU-assisted attack. We’ll let you know once we have it.