Home page logo
/

bugtraq logo Bugtraq mailing list archives

Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability
From: Vulnerability Lab <research () vulnerability-lab com>
Date: Tue, 15 Oct 2013 15:09:36 +0200

Document Title:
===============
Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1105

Video: http://www.vulnerability-lab.com/get_content.php?id=1104


Release Date:
=============
2013-10-04


Vulnerability Laboratory ID (VL-ID):
====================================
1105


Common Vulnerability Scoring System:
====================================
6.1


Product & Service Introduction:
===============================
iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally unveiled in 
2007 
for the iPhone, it has been extended to support other Apple devices such as the iPod Touch (September 2007), iPad 
(January 2010), 
iPad Mini (November 2012) and second-generation Apple TV (September 2010). Unlike Microsoft`s Windows Phone and 
Google`s Android, 
Apple does not license iOS for installation on non-Apple hardware. As of August 2013, Apple`s App Store contained more 
than 900,000 
iOS applications, 375,000 of which were optimised for iPad. These apps have collectively been downloaded more than 50 
billion times. 
It had a 21% share of the smartphone mobile operating system units shipped in the fourth quarter of 2012, behind only 
Google`s Android.
In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod Touch and the 
iPad).[8] At the half 
of 2012, there were 410 million devices activated. According to the special media event held by Apple on September 12, 
2012, 400 million 
devices had been sold by June 2012.

The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control 
elements consist 
of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse 
pinch, all of which 
have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal 
accelerometers are used 
by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three 
dimensions (one 
common result is switching from portrait to landscape mode. iOS is derived from OS X, with which it shares the Darwin 
foundation and 
various application frameworks. iOS is Apple`s mobile version of the OS X operating system used on Apple computers.

Major versions of iOS are released annually. The current release, iOS 7, was released on September 18, 2013. In iOS, 
there are four 
abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The current 
version of the 
operating system (iOS 7.0.2), dedicates 1–1.5 GB of the device`s flash memory for the system partition, using roughly 
800 MB of that 
partition (varying by model) for iOS itself.

(Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a local bypass vulnerability in the official Apple iOS v7.0.1 
Mobile.


Vulnerability Disclosure Timeline:
==================================
2013-04-10:     Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple
Product: iOS 7.0.1

Apple
Product: iOS 7.0.2


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A restricted screen bypass via design glitch is detected in the official Apple iOS v7.0.1 for Mobile Devices 
(iPad|iPhone).
The security vulnerability allows local attackers to bypass the display screen of the restricted sim locked mode.

The bypass vulnerability is located in the iOS v7.0.1/7.0.2 when the `sim locked` mode of an iphone mobile is activated.
Local attackers can redirect the sim locked display to the regular default mode by using a restricted calculator 
function in 
combination with the shutdown and unlock button. As result the local attacker is able to glitch > jump into the regular 
locked 
phone mode with calender + hyperlinks, camera and control center. The regular sim locked display is at the end usable 
like in 
the regular mode without sim locked label in the screen.

The local sim lock screen display bypass vulnerability can be exploited by local attackers with physical device access 
and without 
user interaction. Successful exploitation results in the bypass of the sim lock mode to the regular lock mode. In a 
earlier test (7.x) 
we combined the earlier discovered issues to first unlock the sim display (locked sim card) and bypass the pass code to 
fully compromise.


Proof of Concept (PoC):
=======================
The local vulnerability can be exploited by local attackers with physical device access and without user interaction.
For demonstration or reproduce ...

Manual reproduce like in the iphone poc security video ...

1.  Start your iPhone and ensure you have the iOS v7.0.1 installed
2.  Activate the Sim Lock mode
3.  Start the device new and you will see a black notification in the middle of the display (sim locked)
Note: Sometimes the message also comes up in the restricted mode with a grey message box in the middle of the display.
4.  Open the calender, and scroll down to the two hyper links
5.  Press the power button and wait 2 secounds in the last secound your press one of the two hyperlinks
6.  You get redirected via hyperlink because of the restriction to the pass code sim lock
7.  Press again 3 secound the power button and push at the end in the last secound the home button
8.  Click cancel again in the shutdown menu but hold the home button
9.  Open up the control center and go to the calculator. Now a message box appears automatically with the sim lock 
entry button or the ok cancel
10. Press 3 secounds the shutdown button and in the last secound you press the unlock or ok button and hold home
Note: The pass code module comes up but some milisecounds after it there is an automatic redirect to the earlier opened 
module (calculator)
11. Now the attacker only press one time 3 secounds the power button again and when its opened he press cancel and one 
time the home button
12. The locked screen disappears and the restricted screen display mode has been bypassed.


Video PoC: https://www.youtube.com/watch?v=6_e-hvglQdg


Solution - Fix & Patch:
=======================
7.0.3 ?!


Security Risk:
==============
The security risk of the local sim lock display screen bypass vulnerability is estimated as medium(+)|(-)high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm () evolution-sec com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all 
warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. 
Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss 
of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such 
damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing 
limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack 
into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                             - www.evolution-sec.com
Contact:    admin () vulnerability-lab com      - research () vulnerability-lab com            - admin () evolution-sec 
com
Section:    www.vulnerability-lab.com/dev       - forum.vulnerability-db.com                   - 
magazine.vulnerability-db.com
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab                - 
youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php   - 
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability 
Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the 
use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, 
videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, 
list (feed), 
modify, use or edit our material contact (admin () vulnerability-lab com or research () vulnerability-lab com) to get a 
permission.

                                Copyright © 2013 | Vulnerability Laboratory [Evolution Security]



-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research () vulnerability-lab com



  By Date           By Thread  

Current thread:
  • Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability Vulnerability Lab (Oct 15)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]