Home page logo
/

fulldisclosure logo Full Disclosure mailing list archives

Re: Apple iOS v6.1 (10B143) - Code Lock Bypass Vulnerability #2
From: Julius Kivimäki <julius.kivimaki () gmail com>
Date: Mon, 18 Feb 2013 05:43:48 +0200

If you as you say 'discovered' the exploit, how come you weren't the first
ones to publish it? And why did someone else publish it on the day you
claim you discovered it?

2013/2/18 Vulnerability Lab <research () vulnerability-lab com>

Title:
======
Apple iOS v6.1 (10B143) - Code Lock Bypass Vulnerability #2


Date:
=====
2013-02-16


References:
===========
http://www.vulnerability-lab.com/get_content.php?id=875 (Advisory)
http://www.vulnerability-lab.com/get_content.php?id=874  (Video)


VL-ID:
=====
875


Common Vulnerability Scoring System:
====================================
6.5


Introduction:
=============
iOS (previously iPhone OS) is a mobile operating system developed and
distributed by Apple Inc. Originally released in 2007 for
the iPhone and iPod Touch, it has been extended to support other Apple
devices such as the iPad and Apple TV. Unlike Microsoft`s
Windows Phone (Windows CE) and Google`s Android, Apple does not license
iOS for installation on non-Apple hardware. As of
September 12, 2012, Apple`s App Store contained more than 700,000 iOS
applications, which have collectively been downloaded more
than 30 billion times. It had a 14.9% share of the smartphone mobile
operating system units shipped in the third quarter of 2012,
behind only Google`s Android. In June 2012, it accounted for 65% of mobile
web data consumption (including use on both the iPod
Touch and the iPad). At the half of 2012, there were 410 million devices
activated. According to the special media event held by
Apple on September 12, 2012, 400 million devices have been sold through
June 2012.

The user interface of iOS is based on the concept of direct manipulation,
using multi-touch gestures. Interface control elements
consist of sliders, switches, and buttons. Interaction with the OS
includes gestures such as swipe, tap, pinch, and reverse pinch,
all of which have specific definitions within the context of the iOS
operating system and its multi-touch interface. Internal
accelerometers are used by some applications to respond to shaking the
device (one common result is the undo command) or rotating
it in three dimensions (one common result is switching from portrait to
landscape mode).

iOS is derived from OS X, with which it shares the Darwin foundation. iOS
is Apple`s mobile version of the OS X operating system
used on Apple computers.

In iOS, there are four abstraction layers: the Core OS layer, the Core
Services layer, the Media layer, and the Cocoa Touch layer.
The current version of the operating system (iOS 6.1) dedicates 1-1.5 GB
of the device`s flash memory for the system partition,
using roughly 800 MB of that partition (varying by model) for iOS itself.

Usage: iOS currently runs on iPhone, Apple TV, iPod Touch, and iPad.

(Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )


Abstract:
=========
The Vulnerability Laboratory Research Team discovered a code lock bypass
vulnerability in the official Apple iOS v6.1 (10B143) for iPad & iPhone.


Report-Timeline:
================
2013-02-15:     Public Disclosure


Status:
========
Published


Affected Products:
==================
Apple
Product: iOS 6.1 (10B143)


Exploitation-Technique:
=======================
Local


Severity:
=========
High


Details:
========
A code lock bypass vulnerability via iOS as glitch is detected in the
official Apple iOS v6.1 (10B143) for iPad & iPhone.
The vulnerability allows an attacker with physical access to bypass via a
glitch in the iOS kernel the main device code lock (auth).

The vulnerability is located in the main login module of the mobile iOS
device (iphone or ipad) when processing to use the screenshot function
in combination with the emegerncy call and power (standby) button. The
vulnerability allows the local attacker to bypass the code lock
in iTunes and via USB when a black screen bug occurs.

The vulnerability can be exploited by local attackers with physical device
access without privileged iOS account or required user interaction.
Successful exploitation of the vulnerability results in unauthorized
device access and information disclosure.

Vulnerable OS:
                                                  [+] iOS v6.1 - Apple

Vulnerable Module(s):
                                                  [+] Login - Code Lock

Vulnerable Function(s):
                                                  [+] Power off [Weak up]
(Standby) Button & Square Button in combination with Emergency




Proof of Concept:
=================
The local code lock bypass vulnerability to access the iphone or ipad can
be exploited by local attackers without required user interaction or
privileged iOS user account. For demonstration or reproduce ...

Manually steps to reproduce ... #2

0.  Connect your device with itunes and the appstore to make sure the code
lock is activated
1.  Push the power button (top|right)
2.  The mobile will be activated and the iOS code lock will be visible
3.  Now, you click on the emergency call
4.  Try to dail any random emergency call number from a public listing (we
used 911, 110 and 112)
5.  Call the number and cancel the call directly after the dail without a
direct connection to the number
6.  Push again the power button and push after it the iphone button
(square) in the middle
7.  In the next step you push the power button 3 secounds and in the third
secound you push also with one finger the square and with another the
emergency call button
8.  After pushing all 3 buttons you turn your finger of the square
(middle) button and after it of the power button
9.  The display of the iOS will be black (blackscreen)
10.  Take our your usb plug and connect it with the iOS device in black
screen mode
11. All files like photos, contacts and co. will be available directly
from the device harddrive without the pin to access. Successful reproduced!

Video: http://www.vulnerability-lab.com/get_content.php?id=874
Public Video: http://www.youtube.com/watch?v=DiHz_jkWjsE

0.  http://i45.tinypic.com/2lrfgi.png
1.  http://i48.tinypic.com/10odysn.png
2.  http://i50.tinypic.com/6p181s.png
3.  http://i50.tinypic.com/i4l6r9.png
4.  http://i48.tinypic.com/102nqlu.png
5.  http://i50.tinypic.com/2a9pqqf.png
6.  http://i48.tinypic.com/acsv1c.png
7.  http://i50.tinypic.com/2rcs6dz.png
8.  http://i48.tinypic.com/etbs09.png
9.  http://i50.tinypic.com/23vx5xf.png
10. http://i46.tinypic.com/261i1hd.png
11. http://i48.tinypic.com/acsv1c.jpg
12. http://i46.tinypic.com/2u7x4k7.png
13. http://i47.tinypic.com/k0fzmw.png
14. http://i50.tinypic.com/28mnuw1.png
15. http://i48.tinypic.com/241qd5z.png
16. http://i47.tinypic.com/spximw.png
17. http://i45.tinypic.com/27xil8w.png
18. http://i47.tinypic.com/3090fad.png
19. http://i46.tinypic.com/2vtv5h0.jpg



Risk:
=====
The security risk of the local code lock bypass vulnerability in iOS v6.1
(10B143) is estimated as high.


Credits:
========
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (
bkm () vulnerability-lab com)


Disclaimer:
===========
The information provided in this advisory is provided as it is without any
warranty. Vulnerability-Lab disclaims all warranties,
either expressed or implied, including the warranties of merchantability
and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including
direct, indirect, incidental, consequential loss of business
profits or special damages, even if Vulnerability-Lab or its suppliers
have been advised of the possibility of such damages. Some
states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation
may not apply. We do not approve or encourage anybody to break any vendor
licenses, policies, deface websites, hack into databases
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com
                      - www.vulnerability-lab.com/register
Contact:    admin () vulnerability-lab com         -
support () vulnerability-lab com                -
research () vulnerability-lab com
Section:    video.vulnerability-lab.com         -
forum.vulnerability-lab.com                  - news.vulnerability-lab.com
Social:     twitter.com/#!/vuln_lab             -
facebook.com/VulnerabilityLab                -
youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   -
vulnerability-lab.com/rss/rss_upcoming.php   -
vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this
file requires authorization from Vulnerability Laboratory.
Permission to electronically redistribute this alert in its unmodified
form is granted. All other rights, including the use of other
media, are reserved by Vulnerability-Lab Research Team or its suppliers.
All pictures, texts, advisories, sourcecode, videos and
other information on this website is trademark of vulnerability-lab team &
the specific authors or managers. To record, list (feed),
modify, use or edit our material contact (admin () vulnerability-lab com or
support () vulnerability-lab com) to get a permission.

                                        Copyright © 2012 | Vulnerability
Laboratory



--
VULNERABILITY RESEARCH LABORATORY
LABORATORY RESEARCH TEAM
CONTACT: research () vulnerability-lab com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]