A new vulnerability that affects Apple’s iOS could be exploited by hackers to collect user passwords by using a single email.
Jan Soucek (@jansoucek) , a forensic expert at Ernst and Young has developed a tool, the iOS 8.3 Mail.app inject kit, that could be used to create malicious iCloud password phishing emails. The expert explained that he exploits an unpatched bug affecting Apple iOS.
“Ernst and Young forensic bod Jan Soucek has created a tool capable of generating slick iCloud password phishing emails he says exploits an unpatched bug affecting millions of Apple users.” states the Register.
The iOS 8.3 Mail.app inject kit exploits a vulnerability in the Apple operating system’s native email client that allows and attacker to display a realistic pop-up.
Soucek tried to contact the Apple, but he hasn’t received any reply from Cupertino since January.
“Back in January 2015 I stumbled upon a bug in iOS’s mail client, resulting in HTML tags in email messages not being ignored,” Soucek says.
Soucek discovered that Apple ignores a key line of code in incoming emails: <meta http-equiv=refresh>, this means that an attacker can remotely load arbitrary HTML content inside an email when victims open it on an iPhone, iPad or iPod.
“This bug allows remote HTML content to be loaded, replacing the content of the original email message. JavaScript is disabled in this UIWebView, but it is still possible to build a functional password ‘collector’ using simple HTML and CSS.” said the researcher.
“It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2.”
Attack scenario
The attacker sends a malicious email that looks like it’s from a legitimate source, but instead it propose a realistic input form used to steal victim’s password.
Here’s a video PoC:
(Security Affairs – Apple iOS, hacking)
CISA adds Cisco ASA and FTD and CrushFTP VFS vulnerabilities to its Known Exploited Vulnerabilities…
U.S. CISA added the Windows Print Spooler flaw CVE-2022-38028 to its Known Exploited Vulnerabilities catalog.…
The U.S. Department of Justice (DoJ) announced the arrest of two co-founders of a cryptocurrency mixer…
Google addressed a critical Chrome vulnerability, tracked as CVE-2024-4058, that resides in the ANGLE graphics…
Nation-state actor UAT4356 has been exploiting two zero-days in ASA and FTD firewalls since November…
A malware campaign has been exploiting the updating mechanism of the eScan antivirus to distribute…
This website uses cookies.