WiFiDemon – Recently discovered iPhone Wi-Fi bug could also allow RCE

A recently discovered iPhone Wi-Fi bug that could crash the WiFi connectivity could be exploited by attackers to achieve remote code execution.

In June, the researcher Carl Schou discovered a new bug in iPhone that can permanently break users’ WiFi by disabling it, the issue could be triggered by simply connecting to a rogue hotspot.

Once an iPhone established a WiFi connection to a rogue hotspot, it will no more be able to establish a connection to a Wi-Fi device, even if it is rebooted or the WiFi hotspot is renamed.

Schou noticed the issue because he had problems after logging into his personal WiFi hotspot named %p%s%s%s%s%n using his iPhone running iOS 14.4.2, but the expert noticed that the issue also impacts iPhone XS, running iOS version 14.4.2.

This kind of bug could have a severe impact in a real attack scenario that sees a threat actor setting up an open rogue WiFi hotspot in a crowded area such as a hotel hall or a station.

The only way to restore the Wi-Fi functionality was to reset the network settings of the impacted iPhone.

Independent security researchers speculate that the flaw could be caused by a parsing issue in the Wi-Fi settings.

Apple iOS may be misinterpreting the letters following the character “%” as string-format specifiers instead of considering it as part of the name of the specific hotspot.

The only way to restore a device is to reset your iOS network settings with these simple steps:

Go to Settings on your iPhone, select General.
Select Reset.
Select the ‘Reset Network Settings’ option, the device will reboot and network settings will be reverted to the factory default.

Apple will likely address the flaw with the release of the iOS 14.7 update.

Now researchers from mobile security firm ZecOps discovered that this bug could be exploited to achieve remote code execution (RCE) on target devices by appending the string pattern “%@” to the Wi-Fi hotspot’s name. They tracked the issue as WiFiDemon and explained that it is a zero-click flaw that could allow attackers to infect a device without any user interaction.

The only pre-requisite for the exploitation of the bug is the WiFi to be open with Auto-Join (which is enabled by default).

“As long as the WiFi is turned on this vulnerability can be triggered. If the user is connected to an existing WiFi network, an attacker can launch another attack to disconnect/de-associate the device and then launch this 0-click attack.” states the report published by the experts. “This 0-click vulnerability is powerful: if the malicious access point has password protection and the user never joins the wifi, nothing will be saved to the disk. After turning off the malicious access point, the user’s WIFI function will be normal. A user could hardly notice if they have been attacked.”

The RCE bug affected iOS versions from iOS 14.0 and prior to iOS 14.3. Experts pointed out that Apple “silently” addressed the flaw in January 2021 with the release of iOS 14.4 update.

“However, since this vulnerability was widely published, and relatively easy to notice, we are highly confident that various threat actors have discovered the same information we did, and we would like to encourage an issuance of a patch as soon as possible.” concludes the report.

iPhone and iPad users have to update their devices to the latest iOS version to secure their devices.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, iphone)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.