[FD] Apple iOS v7.1.2 - Merge Apps Service Local Bypass Vulnerability

[Vulnerability Lab <research@xxxxxxxxxxxxxxxxxxxxx>]

Document Title:
===============
Apple iOS v7.1.2 - Merge Apps Service Local Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1280

Video: http://www.vulnerability-lab.com/get_content.php?id=1281

Vulnerability Magazine: 
http://vulnerability-db.com/magazine/articles/2014/09/02/apple-ios-712-device-allows-local-attackers-merge-apps-ahead-pass-code-screen


Release Date:
=============
2014-09-02


Vulnerability Laboratory ID (VL-ID):
====================================
1280


Common Vulnerability Scoring System:
====================================
5.9


Product & Service Introduction:
===============================
iOS (previously iPhone OS) is a mobile operating system developed and 
distributed by Apple Inc. Originally released in 2007 for 
the iPhone and iPod Touch, it has been extended to support other Apple devices 
such as the iPad and Apple TV. Unlike Microsoft`s 
Windows Phone (Windows CE) and Google`s Android, Apple does not license iOS for 
installation on non-Apple hardware. As of 
September 12, 2012, Apple`s App Store contained more than 700,000 iOS 
applications, which have collectively been downloaded more 
than 30 billion times. It had a 14.9% share of the smartphone mobile operating 
system units shipped in the third quarter of 2012, 
behind only Google`s Android. In June 2012, it accounted for 65% of mobile web 
data consumption (including use on both the iPod 
Touch and the iPad). At the half of 2012, there were 410 million devices 
activated. According to the special media event held by 
Apple on September 12, 2012, 400 million devices have been sold through June 
2012.

The user interface of iOS is based on the concept of direct manipulation, using 
multi-touch gestures. Interface control elements 
consist of sliders, switches, and buttons. Interaction with the OS includes 
gestures such as swipe, tap, pinch, and reverse pinch, 
all of which have specific definitions within the context of the iOS operating 
system and its multi-touch interface. Internal 
accelerometers are used by some applications to respond to shaking the device 
(one common result is the undo command) or rotating 
it in three dimensions (one common result is switching from portrait to 
landscape mode).

iOS is derived from OS X, with which it shares the Darwin foundation. iOS is 
Apple`s mobile version of the OS X operating system 
used on Apple computers.

In iOS, there are four abstraction layers: the Core OS layer, the Core Services 
layer, the Media layer, and the Cocoa Touch layer. 
The current version of the operating system (iOS 6.1) dedicates 1-1.5 GB of the 
device`s flash memory for the system partition, 
using roughly 800 MB of that partition (varying by model) for iOS itself. iOS 
currently runs on iPhone, Apple TV, iPod Touch, and iPad.

( Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a pass code (lock screen) 
bypass vulnerability in the Apple (iPhone) iOS v7.1.2 (11D257) mobile device 
system.


Vulnerability Disclosure Timeline:
==================================
2014-07-15: Researcher Notification & Coordination (Benjamin Kunz Mejri - VL 
Core Research Team)
2014-07-16: Vendor Notification (Apple Security Team - Acknowledgement Program)
2014-**-**: Vendor Response/Feedback (Apple Security Team - Acknowledgement 
Program)
2014-**-**: Vendor Fix/Patch (Apple Security Team > Apple Developer Team)
2014-09-02: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple
Product: iOS - Mobile Device System 7.1.2 (11D257)


Exploitation Technique:
=======================
Local


Severity Level:
===============
Medium


Technical Details & Description:
================================
A local pass code (code lock) bypass has been discovered in the Apple (iPhone) 
iOS v7.1.2 (11D257) mobile device system.
The vulnerability allows to bypass via evade or glitch the local pass code 
service of iOS to compromise the mobile device.

The local bypass vulnerability is located in the pass code module of the Apple 
iOS v7.1.2. Local attackers with physical 
access can merge local installed apps and default services via glitch ahead to 
the pass code module of the apple iphone device.
Regular the security policy of the device disallows to merge services ahead to 
the logon screen (pass code).

Local attackers without restricted physcial account can merge apps with 
functions ahead to the pass code module to compromise 
the device. Local attackers with user account can prepare (manipulate) a mobile 
device to access later the restricted context.
During the tests we revealed that the exploitation is only possible (merge apps 
ahead to pass code) when the siri edit command 
context has been involved to save temporarily context.

If the exploitaiton through the glitch was successful the attacker is able to 
prepare calls via app, write emails or access other 
last used apps to compromise the iOS device.

The security risk of the local pass code bypass vulnerability is estimated as 
medium with a cvss (common vulnerability scoring 
system) count of 5.9. Exploitation of the local glitch bypass vulnerability 
requires a privileged web-application user account, 
multi user account or restricted physical device access without user 
interaction. Successful exploitation of the local pass code 
bypass vulnerability results in device compromise or information leaking.

Affected Device(s):
                        [+] Apple > iPhone 5s

Affected OS Version(s):
                        [+] iOS v7.1.2 - 11D257

Tested Device(s):
                        [+] Apple iPhone 5s > iOS 11D257


Proof of Concept (PoC):
=======================
The local pass code bypass vulnerability can be exploited by local attackers 
with privileged device user account without user interaction.
For security demonstration or to reproduce the vulnerability follow the 
provided information and steps below to continue.

Manual steps to reproduce the issue ...

1. Login to your iPhone device and update it to the newst iOS version (7.1.2 - 
11D257)
2. Go to settings > Code (Code Lock Settings) and ensure siri service is 
activated (service activated by default)
3. Lock the iphone or ipad by usage of the power button, slide the to the pass 
code
4. Press the siri button 2 seconds and in the last second the emergency call 
button too 
Note: The siri opens and the emergency call site is in the background. It is 
not allowed to use siri in the emergency call mask!
5. Start siri in the locked iphone/ipad mode
6. Use the command "Open/Call Contact Hacker A A"
Note: The contact you call needs more then 3 entries with the same letter to be 
saved
7. In our tests it opens after the command the siri mask and shows us the 
visible contacts of the phone with the same name
8. Go on top of the mask were the user is able to edit manually the input of 
the command
9. Click to Edit the input field of the siri command on top and save the all 
the input temporarily
10. Now we press 3 seconds the power button and in the third second we press 
also the "Others (Contacts)" button
Note: The contact button allowed in the last version to access the addressbook 
but the issue is patched yet
11. Now we hold the home and siri button together and stop holding the power 
button same time
12. The website with the temp saved content allows to move modules ahead to the 
logon mask with represents a stable security risk
Note: The policy disallows to use any function ahead to the pass code 
(lock-screen) of iOS devices

Case Scenario:
During the security test we used the new iphone 5s of a lab member in our 
office to verify. We included the messages, face-time and 
mail service in front on top of the iOS login mask. The local attacker is able 
to save through the evil glitch any program which is 
available at the phone ahead to the login screen (pass code) module. At the end 
we made jokes by writing messages ahead to the 
phone pass code (lock screen) module. The glitch has been reproduced when the 
watch of the login screen becomes visible in all 
backgrounds of the used app. (watch video!)


Picture(s):
                        ../1.png
                        ../2.png
                        ../3.png
                        ../4.png

Resource(s):
                        ../poc-video.wmv


Security Risk:
==============
The security risk of the local  glitch which allows to compromise the pass code 
is estimated as high(-).


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri 
(bkm@xxxxxxxxxxxxxxxxx) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any 
warranty. Vulnerability Lab disclaims all warranties, either 
expressed or implied, including the warranties of merchantability and 
capability for a particular purpose. Vulnerability-Lab or its suppliers 
are not liable in any case of damage, including direct, indirect, incidental, 
consequential loss of business profits or special damages, even 
if Vulnerability-Lab or its suppliers have been advised of the possibility of 
such damages. Some states do not allow the exclusion or limitation 
of liability for consequential or incidental damages so the foregoing 
limitation may not apply. We do not approve or encourage anybody to break 
any vendor licenses, policies, deface websites, hack into databases or trade 
with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com              
                        - www.evolution-sec.com
Contact:    admin@xxxxxxxxxxxxxxxxxxxxx         - 
research@xxxxxxxxxxxxxxxxxxxxx                        - admin@xxxxxxxxxxxxxxxxx
Section:    dev.vulnerability-db.com            - forum.vulnerability-db.com    
                        - magazine.vulnerability-db.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab 
                        - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - 
vulnerability-lab.com/rss/rss_upcoming.php            - 
vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php    - 
vulnerability-lab.com/list-of-bug-bounty-programs.php - 
vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file 
requires authorization from Vulnerability Laboratory. Permission to 
electronically redistribute this alert in its unmodified form is granted. All 
other rights, including the use of other media, are reserved by 
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, 
advisories, source code, videos and other information on this website 
is trademark of vulnerability-lab team & the specific authors or managers. To 
record, list (feed), modify, use or edit our material contact 
(admin@xxxxxxxxxxxxxxxxxxxxx or research@xxxxxxxxxxxxxxxxxxxxx) to get a 
permission.

                                Copyright © 2014 | Vulnerability Laboratory 
[Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@xxxxxxxxxxxxxxxxxxxxx



_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/