A fix for the security weakness \u2013 CVE-2020-3843<\/a> aka Hairless Huron<\/a> \u2013 arrived in iOS\/iPadOS 13.3.1 and macOS 10.15.3, on January 28, 2020, but wasn’t publicly acknowledged by Apple until February 6, 2020. Apple describes the issue thus: “A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.”<\/p>\n An additional CVE attributed to Beer, CVE-2020-9906<\/a>, capable of causing memory corruption if exploited, was closed in iOS\/iPadOS 13.6. It was disclosed nine days after Apple’s July 15, 2020 bulletin.<\/p>\n Beer’s writeup mentions that he found three zero-day vulnerabilities in the course of his research, but only cites two CVEs. The third appears to be CVE-2020-9844<\/a>, a kernel memory bug credited to Beer that was fixed in iOS\/iPadOS 13.5 in May, 2020. That’s when Beer and Apple say the issue was resolved.<\/p>\n Neither of CVE-2020-9906 nor CVE-2020-9844 received Vulnonym names<\/a>.<\/p>\n Amid the COVID-19 virus lockdown, Beer said he spent six months in his bedroom working on “a wormable radio-proximity exploit which allows me to gain complete control over any iPhone in my vicinity.”<\/p>\n The exploit allowed Beer to access photos, emails, and private messages on the target device, while monitoring it in real-time. No user interaction, such as clicking on a compromised link, is required. And wormable means that compromised devices can themselves compromise other nearby iOS devices.<\/p>\n Beer describes the bug he focused on as “a fairly trivial buffer overflow programming error in C++ code in the kernel parsing untrusted data, exposed to remote attackers.”<\/p>\n And that one bug undid all of the security that should have prevented unauthorized access to the device. It granted the ability to execute arbitrary code and to read and write kernel memory. The research certainly impressed the NSA’s former chief hacker<\/a> Rob Joyce:<\/p>\n Wow. An iOS exploit that doesn\u2019t involve chaining multiple vulnerabilities together is quite an accomplishment. https:\/\/t.co\/ZccMcVTIch<\/a><\/p>\n \u2014 Rob Joyce (@RGB_Lights) December 2, 2020<\/a><\/p><\/blockquote>\n Beer said he found no evidence that the flaw was ever exploited in the wild. However, he pointed out that companies known to provide tools to help governments bypass device security have been paying attention to these sorts of wireless vulnerabilities, and may have the flaw in their arsenals.<\/p>\n The Register<\/i> understands from folks familiar with Apple’s internal handling of the bug disclosure that, as noted above, the issue was resolved in iOS 13.5, and that most users of affected products are already protected due to speed at which the customer base installs operating system updates \u2013 unlike, say, the slow-to-update Android ecosystem. It was also pointed out that that attack requires being within Wi-Fi range.<\/p>\n READ MORE<\/span><\/a><\/div>\n On Twitter, Beer pointed out that with special radio equipment, the attack could be done from hundreds of meters away<\/a>.<\/p>\n A potentially mitigating factor is that AWDL, used for AirDrop file sharing between devices among other things, has to be enabled for the attack to work. However, Beer points out that AWDL is enabled by default, and can be remotely enabled on a locked device as long as the device has been unlocked at least once since it was last powered on.<\/p>\n Beer argues that despite the potential security improvements offered by Arm’s Memory Tagging Extension (MTE<\/a>), Apple should spend more time modernizing critical legacy code in iOS like He also argues for more automated testing, code reviews for code that’s critical for security, better internal documentation, and looking beyond fuzzing to things like variant analysis to stay ahead of attackers. \u00ae<\/p>\n Stuck at home, let’s go digging<\/span>
\n<\/h3>\n\n
![\"apple\"](\"https:\/\/regmedia.co.uk\/2020\/01\/30\/shutterstock_apple.jpg?x=174&y=115&crop=1\")
<\/p>\nFive bag $300,000 in bug bounties after finding 55 security holes in Apple’s web apps, IT infrastructure<\/h2>\n
vm_map.c<\/a><\/code>, written in 1985 and still in use today.<\/p>\n