Categories: HackingSecurity

FireEye discovered an Apple vulnerability which allows iOS keylogging

Researchers at FireEye have developed a POC that exploits an Apple vulnerability to implement a Background Monitoring on Non-Jailbroken iOS 7 Devices.

A vulnerability in Apple products is once again the center of controversy because and also in this case the user’s privacy is at risk. The excellent team of security researchers at FireEye discovered another Apple vulnerability that can be exploited by attackers to track users’ finger swipes on iOS Devices including iPhone and iPad.

Just last week Apple released a security update to iOS (iOS 7.06) to fix a flaw for certificate-validation checks that could be abused by attackers to conduct a man-in-the-middle attack within the victim’s network  to capture or modify data even if protected by SSL/TLS. In reality the checks were present in past versions, but they were not included in the recent version of the operating system for an unspecified amount of time.

This time the exploit targets an Apple vulnerability related to iOS multitasking management, in particular the capabilities to capture user inputs in concomitant with other operations. 

I appreciated the way they were able to bypass the Apple’s app review process to create a “Background Monitoring on Non-Jailbroken iOS 7 Devices” (working on versions 7.0.4, 7.0.5, 7.0.6, and 6.1.x.) and in ethical way they also proposed mitigation strategy. FireEye is actively working with Apple experts on the issue, but it seems that only with the next iOS update will fix it.

“We have created a proof-of-concept “monitoring” app on non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all the user touch/press events in the background, including, touches on the screen, home button press, volume button press and TouchID press, and then this app can send all user events to any remote server”. “Potential attackers can use such information to reconstruct every character the victim inputs.” “Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.” reported the official post. 

Starting on the assumption that on iOS  application running in the background keeps on refreshing itself, the experts at FireEye noted that disabling iOS 7’s “Background App Refresh” setting it is possible to allow keylogging by a malicious app.

 

“iOS7 provides settings for “background app refresh”. Disabling unnecessary app’s background refreshing contributes to preventing the potential background monitoring. However, it can be bypassed. For example, an app can play music in the background without turning on its “background app refresh” switch. Thus a malicious app can disguise itself as a music app to conduct background monitoring.”

Last month, Security researcher Neal Hindocha was developing a Screenlogging malware for the IOS and Android that logs finger swipes on smart devices in combination with taking screenshots.

How to mitigate the risks related to the exploitation of the Apple vulnerability?

Waiting for the next iOS update users have to carefully monitor the unnecessary applications running on their device via Task Manager.

“Before Apple fixes this issue, the only way for iOS users to avoid this security risk is to use the iOS task manager to stop the apps from running in the background to prevent potential background monitoring. iOS7 users can press the Home button twice to enter the task manager and see preview screens of apps opened, and then swipe an app up and out of preview to disable unnecessary or suspicious applications running on the background”  suggest researcher at FireEye.

Pierluigi Paganini

(Security Affairs –  Apple vulnerability, mobile)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco warns of password-spraying attacks targeting Secure Firewall devices

Cisco warns customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services…

3 hours ago

American fast-fashion firm Hot Topic hit by credential stuffing attacks

Hot Topic suffered credential stuffing attacks that exposed customers' personal information and partial payment data.…

7 hours ago

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

21 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

1 day ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

2 days ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

2 days ago

This website uses cookies.