Pierluigi Paganini February 27, 2014

Researchers at FireEye have developed a POC that exploits an Apple vulnerability to implement a Background Monitoring on Non-Jailbroken iOS 7 Devices.

A vulnerability in Apple products is once again the center of controversy because and also in this case the user’s privacy is at risk. The excellent team of security researchers at FireEye discovered another Apple vulnerability that can be exploited by attackers to track users’ finger swipes on iOS Devices including iPhone and iPad.

Just last week Apple released a security update to iOS (iOS 7.06) to fix a flaw for certificate-validation checks that could be abused by attackers to conduct a man-in-the-middle attack within the victim’s network  to capture or modify data even if protected by SSL/TLS. In reality the checks were present in past versions, but they were not included in the recent version of the operating system for an unspecified amount of time.

This time the exploit targets an Apple vulnerability related to iOS multitasking management, in particular the capabilities to capture user inputs in concomitant with other operations. 

I appreciated the way they were able to bypass the Apple’s app review process to create a “Background Monitoring on Non-Jailbroken iOS 7 Devices” (working on versions 7.0.4, 7.0.5, 7.0.6, and 6.1.x.) and in ethical way they also proposed mitigation strategy. FireEye is actively working with Apple experts on the issue, but it seems that only with the next iOS update will fix it.

“We have created a proof-of-concept “monitoring” app on non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all the user touch/press events in the background, including, touches on the screen, home button press, volume button press and TouchID press, and then this app can send all user events to any remote server”. “Potential attackers can use such information to reconstruct every character the victim inputs.” “Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.” reported the official post. 

Starting on the assumption that on iOS  application running in the background keeps on refreshing itself, the experts at FireEye noted that disabling iOS 7’s “Background App Refresh” setting it is possible to allow keylogging by a malicious app.

“iOS7 provides settings for “background app refresh”. Disabling unnecessary app’s background refreshing contributes to preventing the potential background monitoring. However, it can be bypassed. For example, an app can play music in the background without turning on its “background app refresh” switch. Thus a malicious app can disguise itself as a music app to conduct background monitoring.”