IOS Leak Late iPhones And iPads Crashing Within Wifi Range

A vulnerability in iOS allows attackers to iPhones and iPads to let wifi range crashing, allowing the devices in the worst case continue rebooting endlessly. The vulnerability was discovered by researchers at Skycure . For a demonstration of a network attack, the researchers bought a new router and set up in a certain way.

After the researchers had made connection with the router turned the iOS app on their device suddenly crashing. Not much later were other people in the neighborhood to do with crashes. It was found in all cases to iOS users. Further investigation revealed that the problem is caused by specially prepared SSL certificates. Attackers can use this set of apps that crash a SSL connection.

According to the researchers, almost all apps in the Apple App Store use SSL for their communications. An attacker has a lot of opportunities to strike. Not only is it possible to have used apps crash, the vulnerability also affects iOS itself. In certain cases it is possible to restart devices to engage endless, making them unusable, according to the researchers.

"Even if the victims realize that the attack comes from the Wi-Fi network, they can not turn off the WiFi interface." Since the problem is not completely solved by Apple users get the advice to not connect to Wi-Fi networks and suspicious anyway to update to iOS 8.3, as there are some of the problems found "possible" have been corrected.

IP Box Can Lock Screen iPhones Brute forcing

Researchers have discovered a device that makes it possible to brute forcing the lock screen of iPhones and iPads. IP Box, as the device is called, would be used by telephone repairmen to bypass the screen lock of iOS. "This obviously has major implications for the safety and of course was something that we wanted to investigate and validate" said researchers MDSec .

They did eventually get to 200 pounds one of the devices. The IP Box appears to simulate via the USB connection to enter the PIN and also tries all possible pin combinations. According to the researchers, this has been known, but the device also works if the option is enabled to delete the data after 10 attempts.

"Our initial analysis indicates that the IP Box to circumvent the restrictions by making direct with the power of the iPhone connection and aggressively to break the flow after each unsuccessful PIN, but before the attempt is synchronized in the Flash memory." Entering a PIN would therefore take about 40 seconds. A four-digit PIN can therefore be outdated in some 111 hours.

The attack has been tested on iOS 8.1. An attack on iOS 8.2 will follow. The research would show that it is possible to have a leak was discovered last year, but this has yet to be confirmed. The researchers made ​​the following video on YouTube in which the device and the attack will be demonstrated.

Security Expert: Apple Wins Battle Of CIA

This week, The Intercept with a message about attempts by the CIA to crack the security of iPhones and iPads, but according to security expert Robert Graham Apple wins the battle of the American intelligence service. Intercept relies in its own article on documents from whistleblower Edward Snowden, but according to Graham's website saves the completely wrong in its interpretation.

During various conferences CIA would have looked at how information from iPhones can be decrypted. In 2011, when the conference took place, was decrypting encrypted iPhone data time-intensive and did not always work, says Graham. "The context of the presentation was not that she secretly wanted to spy on anyone. The context was that they wanted to decrypt the phones they received."

Contrary to what is in the article The Intercept is claimed Apple would actually win the battle of the CIA, Graham notes."Apple has made it priceless with the iPhone 4 to find out secrets, except in the most important situations, such as phones from the house of Bin Laden." The expert suggests that the iPhone 6 is likely to become impossible. "If the CIA comes to me, I doubt if they managed to get some information from my iPhone."

Xcode
Graham also discusses the trojaning Xcode, the Apple development tool for compiling iOS apps. This intelligence in all apps loopholes could build. "The CIA is not working to the Xcode that everyone used to trojaning. That would be impossible. They trojaning not the version that Apple provides to developers." Who has need Xcode installed according Graham whatsoever to worry.

Even iPhone users would not have to be afraid that Angry Birds contains a backdoor. "The purpose of the CIA are the hundred users of hawala-like app to make money, which is used only by legitimate targets. " In this case, the CIA would the developer of this app to break his or her Xcode a backdoor provided so that eventually all users of the app can be identified.

Malware Explores Home Network Via Router Attack

Researchers have discovered a mysterious instance of malware that attacks the router from infected computers, then bring it home network card and the malware is removed again. It is the Vice Pass Trojan, which occurs at sites like Flash Player update.

When users download the so-called update and open the Trojan is installed. Once active attempts Vice Pass to log in via a list of predefined user names and passwords and a specific range of IP addresses on the router. Then looks malware or other devices are connected to the router, such as iPhones, iPads, LaserJet and Xbox consoles. Once the scan is performed, the malware sends the results back to the attackers and then deletes itself.

Researchers at antivirus company Trend Micro think the Trojan probably "scout" is used for larger campaigns. "The collection of information may be the first step of larger attacks," said analyst Lu Kenney. The collected information could for example be used for cross-site request forgery attacks. "What is the real purpose, this malware shows how important it is to protect devices, even those not obvious target," said Lu. Users will also be advised to change the standard nature credentials of their router.