[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Full-disclosure] Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability

Document Title:
===============
Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1105

Video: http://www.vulnerability-lab.com/get_content.php?id=1104


Release Date:
=============
2013-10-04


Vulnerability Laboratory ID (VL-ID):
====================================
1105


Common Vulnerability Scoring System:
====================================
6.1


Product & Service Introduction:
===============================
iOS (previously iPhone OS) is a mobile operating system developed and 
distributed by Apple Inc. Originally unveiled in 2007 
for the iPhone, it has been extended to support other Apple devices such as the 
iPod Touch (September 2007), iPad (January 2010), 
iPad Mini (November 2012) and second-generation Apple TV (September 2010). 
Unlike Microsoft`s Windows Phone and Google`s Android, 
Apple does not license iOS for installation on non-Apple hardware. As of August 
2013, Apple`s App Store contained more than 900,000 
iOS applications, 375,000 of which were optimised for iPad. These apps have 
collectively been downloaded more than 50 billion times. 
It had a 21% share of the smartphone mobile operating system units shipped in 
the fourth quarter of 2012, behind only Google`s Android.
In June 2012, it accounted for 65% of mobile web data consumption (including 
use on both the iPod Touch and the iPad).[8] At the half 
of 2012, there were 410 million devices activated. According to the special 
media event held by Apple on September 12, 2012, 400 million 
devices had been sold by June 2012.

The user interface of iOS is based on the concept of direct manipulation, using 
multi-touch gestures. Interface control elements consist 
of sliders, switches, and buttons. Interaction with the OS includes gestures 
such as swipe, tap, pinch, and reverse pinch, all of which 
have specific definitions within the context of the iOS operating system and 
its multi-touch interface. Internal accelerometers are used 
by some applications to respond to shaking the device (one common result is the 
undo command) or rotating it in three dimensions (one 
common result is switching from portrait to landscape mode. iOS is derived from 
OS X, with which it shares the Darwin foundation and 
various application frameworks. iOS is Apple`s mobile version of the OS X 
operating system used on Apple computers.

Major versions of iOS are released annually. The current release, iOS 7, was 
released on September 18, 2013. In iOS, there are four 
abstraction layers: the Core OS layer, the Core Services layer, the Media 
layer, and the Cocoa Touch layer. The current version of the 
operating system (iOS 7.0.2), dedicates 1–1.5 GB of the device`s flash memory 
for the system partition, using roughly 800 MB of that 
partition (varying by model) for iOS itself.

(Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a local bypass 
vulnerability in the official Apple iOS v7.0.1 Mobile.


Vulnerability Disclosure Timeline:
==================================
2013-04-10:     Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple
Product: iOS 7.0.1

Apple
Product: iOS 7.0.2


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A restricted screen bypass via design glitch is detected in the official Apple 
iOS v7.0.1 for Mobile Devices (iPad|iPhone).
The security vulnerability allows local attackers to bypass the display screen 
of the restricted sim locked mode.

The bypass vulnerability is located in the iOS v7.0.1/7.0.2 when the `sim 
locked` mode of an iphone mobile is activated.
Local attackers can redirect the sim locked display to the regular default mode 
by using a restricted calculator function in 
combination with the shutdown and unlock button. As result the local attacker 
is able to glitch > jump into the regular locked 
phone mode with calender + hyperlinks, camera and control center. The regular 
sim locked display is at the end usable like in 
the regular mode without sim locked label in the screen.

The local sim lock screen display bypass vulnerability can be exploited by 
local attackers with physical device access and without 
user interaction. Successful exploitation results in the bypass of the sim lock 
mode to the regular lock mode. In a earlier test (7.x) 
we combined the earlier discovered issues to first unlock the sim display 
(locked sim card) and bypass the pass code to fully compromise.


Proof of Concept (PoC):
=======================
The local vulnerability can be exploited by local attackers with physical 
device access and without user interaction.
For demonstration or reproduce ...

Manual reproduce like in the iphone poc security video ...

1.  Start your iPhone and ensure you have the iOS v7.0.1 installed
2.  Activate the Sim Lock mode
3.  Start the device new and you will see a black notification in the middle of 
the display (sim locked)
Note: Sometimes the message also comes up in the restricted mode with a grey 
message box in the middle of the display.
4.  Open the calender, and scroll down to the two hyper links
5.  Press the power button and wait 2 secounds in the last secound your press 
one of the two hyperlinks
6.  You get redirected via hyperlink because of the restriction to the pass 
code sim lock
7.  Press again 3 secound the power button and push at the end in the last 
secound the home button
8.  Click cancel again in the shutdown menu but hold the home button
9.  Open up the control center and go to the calculator. Now a message box 
appears automatically with the sim lock entry button or the ok cancel
10. Press 3 secounds the shutdown button and in the last secound you press the 
unlock or ok button and hold home
Note: The pass code module comes up but some milisecounds after it there is an 
automatic redirect to the earlier opened module (calculator)
11. Now the attacker only press one time 3 secounds the power button again and 
when its opened he press cancel and one time the home button
12. The locked screen disappears and the restricted screen display mode has 
been bypassed.


Video PoC: https://www.youtube.com/watch?v=6_e-hvglQdg


Solution - Fix & Patch:
=======================
7.0.3 ?!


Security Risk:
==============
The security risk of the local sim lock display screen bypass vulnerability is 
estimated as medium(+)|(-)high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri 
(bkm@xxxxxxxxxxxxxxxxx) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, 
indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have 
been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential 
or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor 
licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
               - www.evolution-sec.com
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - 
research@xxxxxxxxxxxxxxxxxxxxx               - admin@xxxxxxxxxxxxxxxxx
Section:    www.vulnerability-lab.com/dev       - forum.vulnerability-db.com    
               - magazine.vulnerability-db.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
               - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is 
granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All 
pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the 
specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@xxxxxxxxxxxxxxxxxxxxx or 
research@xxxxxxxxxxxxxxxxxxxxx) to get a permission.

                                Copyright © 2013 | Vulnerability Laboratory 
[Evolution Security]




-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/