iOS 9 drops today, and includes a patch for the vulnerability that lets attackers bomb any iOS and Mac device within Bluetooth range, via the Airdrop file-sharing feature.

Dark Reading Staff, Dark Reading

September 17, 2015

1 Min Read

iOS 9 dropped today, and a security researcher has already provided one reason to make the upgrade: a vulnerability in the AirDrop file-sharing feature that allows attackers to bomb any iOS or Mac device within Bluetooth range with malware. The bug has been patched in iOS 9.

Australian researcher Mark Dowd, founder and director of Azimuth Security, discovered and reported the vulnerability to Apple last month. He produced the demo below:

"This attack could be performed in public areas, such as coffee shops, stores, public transit or any other area where the phone is within wireless by the attacker," says Tod Beardsley, security research manager for Rapid7. "This attack is also pretty stealthy, as little to no user interaction is required, and the malware would remain dormant until an eventual reboot of the phone. ...

"It's important to note that the default setting in iOS is to only allow AirDrop from contacts," says Beardsley. "This limits this particular attack to only to attackers who are already known and in the target's phone contacts list. That said, disabling it completely, along with Bluetooth and regular WiFi, when not actively in use will reduce your overall attack surface, and incidentally will save some battery life, too."

Read more at Forbes.

About the Author(s)

Dark Reading Staff

Dark Reading

Dark Reading is a leading cybersecurity media site.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights