iOS 9 drops today, and includes a patch for the vulnerability that lets attackers bomb any iOS and Mac device within Bluetooth range, via the Airdrop file-sharing feature.
iOS 9 dropped today, and a security researcher has already provided one reason to make the upgrade: a vulnerability in the AirDrop file-sharing feature that allows attackers to bomb any iOS or Mac device within Bluetooth range with malware. The bug has been patched in iOS 9.
Australian researcher Mark Dowd, founder and director of Azimuth Security, discovered and reported the vulnerability to Apple last month. He produced the demo below:
"This attack could be performed in public areas, such as coffee shops, stores, public transit or any other area where the phone is within wireless by the attacker," says Tod Beardsley, security research manager for Rapid7. "This attack is also pretty stealthy, as little to no user interaction is required, and the malware would remain dormant until an eventual reboot of the phone. ...
"It's important to note that the default setting in iOS is to only allow AirDrop from contacts," says Beardsley. "This limits this particular attack to only to attackers who are already known and in the target's phone contacts list. That said, disabling it completely, along with Bluetooth and regular WiFi, when not actively in use will reduce your overall attack surface, and incidentally will save some battery life, too."
Read more at Forbes.
About the Author(s)
You May Also Like
Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024