Mobile
3/6/2014
10:31 AM
Connect Directly
RSS
E-Mail
50%
50%

Apple iOS Vulnerable To Hidden Profile Attacks

Unpatched flaw in iOS enables malicious profile users to secretly control devices and intercept data.

Apple iOS users: Beware malicious profiles that can be hidden by attackers, thus making them extremely difficult to eradicate.

Yair Amit, CTO of Skycure, sounded that warning last week at the RSA conference in San Francisco. Amit delivered a presentation focusing on how an attacker could create a malicious access point name (APN) and cellular data settings file -- stored as a "profile" in the "general" iOS settings menu -- to control devices and intercept data.

These profiles, also known as mobileconfig files, are XML-based files used by telcos, mobile device management (MDM) providers, and some mobile applications to configure everything from WiFi and VPN to email and cellular settings. "When used by mobile device manufacturers and carriers, this is actually a great feature," Amit said in a phone interview.

For example, the APN Changer site allows iPhone and iPad users to load APN -- carrier settings -- profiles that allow them to use unofficial carrier SIMs with their devices. Numerous anecdotal reports have said that AT&T retail store staff members regularly download profiles from the APN Changer website when configuring devices for "pay as you go" iPhone customers.

[Looking to keep spying eyes out of your messages? See Cryptocat Wins Apple Approval.]

Using a VPN connection to a reporter's iPhone, however, Amit demonstrated how -- after an iPhone user loaded a malicious profile -- an attacker could open arbitrary applications, make the browser load arbitrary URLs, or run search queries, and how all traffic flowing to or from the device could be sniffed, no matter whether the individual apps were using SSL/TLS or browsing HTTPS sites. As a result, everything from Facebook to banking sessions could be monitored. Furthermore, if combined with known vulnerabilities in various MDM products, Amit said an attacker could not only subvert an iOS device, but also MDM controls.

"We see a bigger picture, of an attack that can access all of the stuff on your device -- both personal and for business -- and remain undetectable, and for that reason, we find it very important to remind people about these problems, and to be sure they update their operating systems," Amit said.

While the threat of malicious profiles has been known for some time, the vulnerability recently detailed by Skycure would enable an attacker to hide their profile after a user was tricked into installing it. "We recently found a vulnerability on iOS that allows [someone] to make these profiles, once installed, completely hidden, which means that not you or your admin can know that such a profile runs on your device," Amit said.

He declined to demonstrate that vulnerability on the reporter's iPhone -- saying that once the profile was loaded and hidden, it became quite difficult to remove -- and noted that Apple plans to patch the flaw with the release of iOS 7.1. "We will not disclose technical details until iOS 7.1 is released," he said.

Apple Insider reported this week that Apple will likely release iOS 7.1 later this month, which includes a number of features designed to make it easier for IT administrators to automate MDM setup for wireless devices. That feature could be used to configure thousands of devices rapidly, for example in enterprise or educational settings.

But like recent versions of iOS, the update will likely patch not just the hidden-profile vulnerability but also other flaws that might be exploited by attackers, including a background monitoring vulnerability disclosed last month by FireEye, which affects iOS 6 and iOS 7.

Apple released an emergency fix for a "goto fail" SSL/TLS flaw (also known as CVE-2014-1266) on February 25, in the form of iOS 7.0.6. (Apple also fixed the flaw in OS X Mavericks by releasing OS X Mavericks 10.9.2.)

Attackers could exploit the flaw to eavesdrop on the communications of any vulnerable device, provided that the attacker was on the same network or WiFi hotspot as the target.

"To mitigate the risk of this vulnerability it's crucial to notify employees using vulnerable devices that they shouldn't connect to public WiFi access points," said Dirk Sigurdson, director of engineering for Rapid7's Mobilisafe, in a blog post. "It's nearly impossible to discern legitimate public access points from those setup to steal data, and so devices that are vulnerable to this attack should stay on private ones."

Fewer than half of iOS devices are running the latest software update.
Fewer than half of iOS devices are running the latest software update.

The best fix for the flaw is simply to update vulnerable devices to iOS 7.0.6, which runs on the iPhone 4 (and newer devices), iPod Touch (5th generation), and iPad 2 and newer devices. "Don't make the assumption that employees will automatically update their devices to address this issue," Sigurdson said.

According to a survey of millions of iOS devices in the United States and Canada that are using the web, as of Tuesday, 45% of all iOS users were employing version 7.0.6, Andrew Waber, a market analyst at online advertising network Chitika, said via email. That's a noticeable jump in iOS 7.0.6 from one week ago, when just 20% of users had adopted the latest version of the operating system.

But as of Tuesday, 36% of iPhone and iPad users were still running a version of iOS 7 that was vulnerable to the SSL/TLS goto-fail flaw.

IT is turbocharging BYOD, but mobile security practices lag behind the growing risk. Also in the Mobile Security issue of InformationWeek: These seven factors are shaping the future of identity as we transition to a digital world. (Free registration required.)

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter. View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Containing Corporate Data on Mobile Devices
Containing Corporate Data on Mobile Devices
If you’re still focused on securing endpoints, you’ve got your work cut out for you. WiFi network provider iPass surveyed 1,600 mobile workers and found that the average US employee carries three devices -- a smartphone, a computer, and a tablet or e-reader -- with more than 80% of them doing work on personal devices.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

CVE-2014-7292
Published: 2014-10-23
Open redirect vulnerability in the Click-Through feature in Newtelligence dasBlog 2.1 (2.1.8102.813), 2.2 (2.2.8279.16125), and 2.3 (2.3.9074.18820) allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the url parameter to ct.ashx.

CVE-2014-8071
Published: 2014-10-23
Multiple cross-site scripting (XSS) vulnerabilities in OpenMRS 2.1 Standalone Edition allow remote attackers to inject arbitrary web script or HTML via the (1) givenName, (2) familyName, (3) address1, or (4) address2 parameter to registrationapp/registerPatient.page; the (5) comment parameter to all...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.