Slashdot Mirror
iOS WiFi Bug Allows Remote Reboot of All Devices In Area
New submitter BronsCon writes: A recently disclosed flaw in iOS 8 dubbed "No iOS Zone" allows an attacker to create a WiFi hot spot that will cause iOS devices to become unstable, crash, and reboot, even when in offline mode. Adi Sharabani and Yair Amit of Skycure are working with Apple for a fix; but, for now, the only workaround is to simply not be in range of such a malicious network.
So I can get a seat at my local coffee house.
...of Microsoft-free Fridays?
Do not look into laser with remaining eye.
Exactly how does that work if the wifi is turned off?
“He’s not deformed, he’s just drunk!”
Seriously. the fact that offline mode is not offline is a bigger issue that this exploit.
That's a literal "work around".
Heh.
I'll get my coat.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
You're being somewhere wrong
I thought I was going to get First Post, but then this iPhone kept constantly rebooting.
#DeleteChrome
I would agree that this is very much the more interesting point, that if you have turned off the antennas, it is still listening. NSA, is this a feature for you?
It's not that a phone that's offline is still vulnerable to wifi; it's that once this attack (which is carefully designed to get this result) hits you can't get enough control to go offline. The summary's got an inaccurate paraphrase, but TFA's phrasing isn't immediately clear. The researcher's blog has a better description.
If you have your phone set to connect to any available network, re-connect to wifi networks you have joined before, and to continually broadcast those SSIDs one by one until it receives a response, then don't be surprised to get owned every now and then you're following the 802.11 standard correctly.
If your phone is set to connect to networks with names like "attwifi" or "xfinitiwifi", then... well, that's what it will do.
So my Android device can act an an AP, is there an app for this yet?
even in "offline mode"? iPhone doesnt have an offline mode but an airplane mode and the story is 100% bullshit if he is claiming it can do this to a phone that is in airplane mode
That's not what they are saying... IF you have the phone in Airplane mode, you will have no problem. HOWEVER, if you don't and your phone tries to connect to the rouge AP then it crashes and reboots. At that point you are sunk because when your phone boots and it wasn't previously in Airplane mode, it will connect to the rouge AP and crash before you can get the phone into Airplane mode to stop the cycle.
So if your WiFi is actually turned off, nothing will happen. The problem is that once you get into this cycle, you cannot turn off the WiFi before the phone crashes and boots again. The only way to recover is to get out of range of the rouge AP so you can stop the crash, boot, crash cycle.
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
They use the word "force", but as the attack was originally described, what they're actually talking about doing is spoofing a network that your device already recognizes. More or less, if an attacker knows your home WiFi SSD or can make a lucky guess about what other SSIDs your device might already recognize (e.g. ones that your device was programmed to know out of the box), they can name their malicious network in such a way to possibly get you to automatically connect to it as a recognized network.
There's nothing particularly novel about that attack, and contrary to their verbiage, it doesn't force anyone to join a network, nor can it even easily be used in conjunction with this attack for the vast majority of users. Is it a potential problem? Absolutely, but only for a small subset of users. The way they're phrasing it and talking about it, it seems pretty clear that they're trying to boost their own profile a bit. For most cases, the two attacks can't be used together unless the malicious agent is stalking their victim.
More or less, if an attacker knows your home WiFi SSD or can make a lucky guess about what other SSIDs your device might already recognize (e.g. ones that your device was programmed to know out of the box [e.g. attwifi, for 34% of users]), they can name their malicious network in such a way to possibly get you to automatically connect to it as a recognized network.
Hmm...
There's nothing particularly novel about that attack, and contrary to their verbiage, it doesn't force anyone to join a network, ...
34% of users can't tell their iPhones not to connect to a hotspot named attwifi. That sounds like the ability to force connection to a WiFi network to me.
... nor can it even easily be used in conjunction with this attack for the vast majority of users.
I'll grant you that, 66% is the vast majority. However ...
Is it a potential problem? Absolutely, but only for a small subset of users.
... 34% is not a small subset.
The way they're phrasing it and talking about it, it seems pretty clear that they're trying to boost their own profile a bit.
This I can agree with. It's what lead to the inaccuracy in the summary in the first place.
For most cases, the two attacks can't be used together unless the malicious agent is stalking their victim.
You're right, 66% does constitute "most cases"; 34% of all iPhones sold in the last 3.5 years (that is to say, realistically, damn near 34% of all iPhones currently in use) still seems like a pretty large victim pool, though.
So yes, perhaps the severity of the flaw was a bit overblown by the team that discovered it, but I think you're trying to let out a bit too much of the air.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Carry a Faraday cage with you, put your phone in it, reboot, and once it's rebooted, unlock the phone and turn off the WiFi.
You'll need to make it big enough to cover your hand and phone and transparent enough to see what you are doing.
It won't be complete because unless the Faraday cage covers your entire body (including your feet), the malicious WiFi signal could theoretically come through where your arm is. But unless the signal is really strong or bouncing off the wall behind you, you should be able to orient yourself so that the signal is too weak to be picked up by your phone.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.