iOS WiFi Bug Allows Remote Reboot of All Devices In Area

New submitter BronsCon writes: A recently disclosed flaw in iOS 8 dubbed "No iOS Zone" allows an attacker to create a WiFi hot spot that will cause iOS devices to become unstable, crash, and reboot, even when in offline mode. Adi Sharabani and Yair Amit of Skycure are working with Apple for a fix; but, for now, the only workaround is to simply not be in range of such a malicious network.

Comments

Got to build one of those

[jfdavis668]

So I can get a seat at my local coffee house.

Re:Got to build one of those

[toonces33]

Take it to the airport, or take it on the subway.

Just for grins, I downloaded all of the sounds that an iPhone makes onto my Android phone. In a quiet room, I can play the 'bing' noise that indicates an incoming message, or the noise that an iPhone makes when the battery is low. And then watch to see what kind of reaction there is from the people who are nearby.

Re:Got to build one of those

[Anonymous Coward]

My time is worthless as well. Plus I too have incredibly low standards for comedy. We should be friends.

even when in offline mode

[fustakrakich]

Exactly how does that work if the wifi is turned off?

Re:even when in offline mode

[Anonymous Coward]

You're turning WiFi off wrong.

Re:even when in offline mode

[Anubis IV]

I was curious as well, so I read through their presentation slides and their press release.

The gist of the attack is that they've crafted a malicious SSL cert that can cause strange behavior in apps and the OS itself, including the possibility of initiating a crash-reboot-get malicious SSL cert-crash cycle. Once you get stuck in that cycle, there's no way to turn off WiFi, hence why they said that offline mode would not remedy the issue. That said, offline mode can indeed keep you from getting stuck in that cycle to begin with, and the researchers even recommended it as one of the ways to avoid the problem entirely. Alternatively, if it's already too late for you and you're in the crash loop, simply leaving the area will fix the issue for you, since you'll be able to pull down valid SSL certs and reboot as normal.

Which is to say, the summary has it wrong, since the attack cannot cause you to enter the crash loop while you're in offline mode, but you won't be able to enter offline mode once you're in the crash loop, so offline mode cannot save you at that point. Only leaving the area will work.

Oblig Steve Jobs paraphrase

[Anonymous Coward]

You're being somewhere wrong

Re:How is it working in offline mode

[BronsCon]

Actually, after giving the article another read-through, I think I got it wrong in the summary. The reboot cycle happens so quickly that, once you've entered it, you don't have the opportunity to turn WiFi off until you've left the range of the rogue AP. The article really isn't clear on that point, but it may well be that, if you have WiFi turned off already, you're safe.

Darn it

[93 Escort Wagon]

I thought I was going to get First Post, but then this iPhone kept constantly rebooting.

Re:How is it working in offline mode

[Minwee]

Actually, after giving the article another read-through, I think I got it wrong in the summary.

Are you sure you're a Slashdot submitter?

Oh, I see you're new here. Don't worry, after a while you'll stop caring about having anything correct in the summary at all.

Re:How is it working in offline mode

[Carewolf]

Actually, after giving the article another read-through, I think I got it wrong in the summary.

Are you sure you're a Slashdot submitter?

Oh, I see you're new here. Don't worry, after a while you'll stop caring about having anything correct in the summary at all.

If you do manage to get the summary right, you can be sure an editor will fix that mistake.