Apple news: iLeakage attack, MAC address leakage bug
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-32434 | Integer Overflow in Apple iOS, iPadOS, macOS and watchOS Grants Kernel-Privilege Code Execution CVE-2023-32434 is an integer overflow (CWE-190) in a kernel component of Apple's operating systems, caused by insufficient input validation. It is triggered when a malicious or compromised app processes input that overflows an integer value, allowing the attacker's code to escape the app sandbox. Successful exploitation lets an app execute arbitrary code with kernel privileges, the highest level of access on the device, giving full control of the affected iPhone, iPad, Mac or Apple Watch. All devices running iOS/iPadOS before 16.5.1 (or 15.7.7 on the iOS 15 branch), macOS Ventura before 13.4.1, macOS Monterey before 12.6.7, macOS Big Sur before 11.7.8, or watchOS before 9.5.2 (or 8.8.1) are affected, which spans Apple's entire device ecosystem. Exploitation is confirmed in the wild: Apple reported the flaw was actively exploited against iOS versions released before iOS 15.7, CISA added it to the KEV catalog on 2023-06-23, and news reports link it to the Operation Triangulation spyware campaign and commercial iOS exploit kits. Do: Immediately update devices: iOS/iPadOS 16.5.1 (or iOS/iPadOS 15.7.7 for older models), macOS Ventura 13.4.1, Monterey 12.6.7, or Big Sur 11.7.8, and watchOS 9.5.2 (or watchOS 8.8.1 for older models), per the CISA KEV required action. Use MDM or device inventories to confirm fleet-wide patch compliance, prioritizing externally used and executive devices. Until patched, have users avoid installing or opening untrusted apps, since exploitation requires a local app as the delivery vector. | 7.8 | 52% | KEV |
| masswell over 1 billion devices (Apple's entire iPhone, iPad, Mac and Apple Watch installed base was exposed prior to the June 2023 updates) | |
| CVE-2023-42846 | This issue was addressed by removing the vulnerable code. This issue was addressed by removing the vulnerable code. This issue is fixed in watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1, iOS 17.1 and iPadOS 17.1. A device may be passively tracked by its Wi-Fi MAC address. NVD description · AI analysis pending | 5.3 | 1% |
| — |
Full article542 words · extracted from helpnetsecurity.com · click to collapse
On Wednesday, Apple released security updates for all supported branches of iOS and iPadOS, macOS, tvOS, watchOS and Safari.
This time around, the updates did not garner as much attention as when they deliver a zero-day fix, though it has to be mentioned that the company has finally delivered a patch for CVE-2023-32434, a code execution vulnerability exploited to deliver the extremely stealthy TriangleDB spyware, to the currentlu oldest supported iOS/iPadOS branch (15.x).
MAC address leakage
Another vulnerability of note fixed this Wednesday with the release of iOS 17.1 and iPadOS 17.1, iOS 16.7.2 and iPadOS 16.7.2, tvOS 17.1 and watchOS 10.1 is CVE-2023-42846, a bug that made a privacy-enhancing feature (“Private Wi-Fi Address”) not work as intended.
Discovered and reported by Talal Haj Bakry and Tommy Mysk of Mysk Inc., the vulnerability allowed the tracking of users’ iPhone across different Wi-Fi networks by their device’s static MAC address.
“Ever since it was introduced [in iOS 14], the feature was completely useless. While iOS replaces the device’s real MAC address in the data link layer with a generated address per network, it includes the real MAC address in the AirPlay discovery requests that an iPhone starts sending when it joins a network,” the researchers explained.
“There is no way to prevent iPhones and iPads from sending AirPlay discovery requests, even when connected to a VPN.” As Mysk confirmed to Ars Technica, Lockdown Mode is equally toothless in this regard.
Apple said it has plugged the security hole by “removing the vulnerable code,” but offered no detailed explanation. Also, the fix is yet to be delivered to the iOS 15.x branch.
iLeakage side channel attack
A group of researchers has developed a side-channel attack exploiting Apple A-series or M-series CPUs’ speculative execution capability to extract sensitive information (such as autofilled passwords or Gmail inbox content) when a Safari user lands on a specially crafted webpage.
“Code running in one web browser tab should be isolated and not be able to infer anything about other tabs that a user has open. However, with iLeakage, malicious JavaScript and WebAssembly can read the content of a target webpage when a target visits and clicks on an attacker’s webpage. This content includes personal information, passwords, or credit card information,” they shared.
The attack can also be leveraged against Chrome, Firefox and Edge users on iOS, since they use Safari’s JavaScript engine.
“[Those mobile browsers] are simply wrappers on top of Safari that provide auxiliary features such as synchronizing bookmarks and settings. Consequently, nearly every browser application listed on the App Store is vulnerable to iLeakage,” they added.
Technical information about the attack can be found in this paper.
The researchers pointed out that the attack is “significantly difficult” to orchestrate end-to-end (also, the rate of sensitive data extraction is very slow) and that they currently do not have evidence that iLeakage has been abused by attackers.
They disclosed their research to Apple in September 2022, but there is no fix available.
There are possible mitigations, though: users can switch to Lockdown Mode or disable JavaScript in the browser. But both options have drawbacks: Lockdown Mode comes with potentially unwanted limitations, and disabling JavaScript will “break” certain webpages one might want to visit.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/10/27/ileakage-attack-mac-address-leakage/