• Home
  • iOS
  • News
  • Researchers Use SSL Security Bug to Crash iOS Devices via Fake Wi-Fi Hotspot

Researchers Use SSL Security Bug to Crash iOS Devices via Fake Wi-Fi Hotspot

Researchers Use SSL Security Bug to Crash iOS Devices via Fake Wi-Fi Hotspot

Researchers have used a bug in the iOS secure sockets layer (SSL) library to cause both iOS apps, as well as the devices themselves, to crash when connected to a malicious Wi-Fi hotspot.

Researchers Use SSL Security Bug to Crash iOS Devices via Fake Wi-Fi Hotspot

AppleInsider:

The attack, discovered by Skycure researchers Yair Amit and Adi Sharabani, takes advantage of an issue with iOS’s parsing of SSL certificates. By sending a specially-crafted certificate to a device via a Wi-Fi hotspot, the duo was able to repeatedly crash both individual apps and iOS itself.

A modified version of the attack was able to put an iOS device into a perpetual reboot cycle for as long as the device was in range of the malicious hotspot.

Reserchers were able to force the devices to connect to the malicious hotspot, using an older exploit known as WifiGate:

iOS devices are pre-programmed by the carrier to automatically connect to certain networks. For example, US customers on the AT&T network will auto-connect to any network called ‘attwifi’. There’s no way to prevent your phone from doing this, short of turning Wi-Fi off altogether. – Gizmodo, via 9to5Mac

The researchers have declined to reveal the exact details of their attack method, and contacted Apple about the issue, and are reported to be working with the company on a fix.

Researchers suggest the following until a fix is developed:

  1. Users should disconnect from the bad Wi-Fi network or change their location in case they experience continuous crashing or rebooting.
  2. The latest iOS 8.3 update might have fixed a few of the mentioned threats–users are highly advised to upgrade to the latest version.
  3. In general, users should avoid connecting to any suspicious “FREE” Wi-Fi network.

Related

  1. Apple’s iPad Air 2 – Thinner, Faster, Improved Touch ID
  2. Verizon iPad Ships Unlocked, Works on AT&T 3G Networks
  3. WWDC 2013: iOS 7 Find my iPhone Now Includes Activation Lock for Added Security
  4. San Francisco Says ‘We Won’t Buy Mac’ Following Apple’s EPEAT Withdrawal
  5. Twitter for Mac Updated – Adds Support for Multiple Photos in a Tweet, More
  6. Apple Attempts to Add Samsung Galaxy S4 to U.S. Patent Suit
Apple Giveaways

iPhone X Giveaway

$999

Enter

MacBook Pro Giveaway

$1499.00

Enter

10.5″ iPad Pro Giveaway

$649.00

Enter

iPhone 8 Plus Giveaway

$800.00

Enter
Share