Apple iOS flaw exploitable to steal user password with a phishing email

A security expert demonstrated how to exploit a vulnerability in Apple IOS system to steal user password with a phishing email.

A new vulnerability that affects Apple’s iOS could be exploited by hackers to collect user passwords by using a single email.

Jan Soucek (@jansoucek) , a forensic expert at Ernst and Young has developed a tool, the iOS 8.3 Mail.app inject kit, that could be used to create malicious iCloud password phishing emails. The expert explained that he exploits an unpatched bug affecting Apple iOS.

“Ernst and Young forensic bod Jan Soucek has created a tool capable of generating slick iCloud password phishing emails he says exploits an unpatched bug affecting millions of Apple users.” states the Register.

The iOS 8.3 Mail.app inject kit exploits a vulnerability in the Apple operating system’s native email client that allows and attacker to display a realistic pop-up.

Soucek tried to contact the Apple, but he hasn’t received any reply from Cupertino since January.

“Back in January 2015 I stumbled upon a bug in iOS’s mail client, resulting in HTML tags in email messages not being ignored,” Soucek says.

Soucek discovered that Apple ignores a key line of code in incoming emails: <meta http-equiv=refresh>, this means that an attacker can remotely load arbitrary HTML content inside an email when victims open it on an iPhone, iPad or iPod.

“This bug allows remote HTML content to be loaded, replacing the content of the original email message. JavaScript is disabled in this UIWebView, but it is still possible to build a functional password ‘collector’ using simple HTML and CSS.” said the researcher.

“It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2.”

Attack scenario

The attacker sends a malicious email that looks like it’s from a legitimate source, but instead it propose a realistic input form used to steal victim’s password.

Here’s a video PoC:

Pierluigi Paganini

(Security Affairs – Apple iOS, hacking)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.