Security Researcher Discovers Snippet of CSS Code That Forces iOS to Reboot, Apple Investigating

Monday September 17, 2018 6:23 AM PDT by Mitchel Broussard
A new iOS vulnerability was discovered by a security researcher over the weekend, causing affected iPhones and iPads to crash and restart when following a link to an HTML page hosting specially crafted CSS code.

The vulnerability hits the WebKit rendering engine used in Safari by applying a CSS effect -- "backdrop-filter" -- that requires enough heavy graphics processing to cause iOS to crash completely.

Software engineer and security researcher Sabri Haddouche, who works for encrypted messaging app Wire, discovered the vulnerability and shared videos of its effects on Twitter. Haddouche also discussed his findings with ZDNet:
"The attack uses a weakness in the -webkit-backdrop-filter CSS property, which uses 3D acceleration to process elements behind them," Haddouche told ZDNet in an interview.

"By using nested divs with that property, we can quickly consume all graphic resources and freeze or kernel panic the OS."
Apple has been notified of the vulnerability, and Haddouche confirmed that the company is actively investigating the issue. The researcher also notes that the CSS code in its current form will freeze Safari on macOS "for a minute," and then slow it down, but the Mac won't crash. However, a modified version with Javascript could end with the same outcome as the iOS version, crashing the Mac computer that it's on.

Haddouche didn't publish the modified macOS vulnerability because once the computer reboots, Safari persists and the browser is automatically launched again with the same result, resulting in a cycle of reboots. The researcher says that he discovered the vulnerabilities during research for denial of service bugs on different web browsers.

Tag: Vulnerabiltiies
25 comments

Top Rated Comments

(View all)
Avatar
H2SO4
15 months ago

Unfortunately, he gives enough details for people to try exploiting the bug themselves.

It needs to be done. That’s how you keep big companies from brushing things under the carpet.
There are plenty of exploits Apple and others have ignored and continue to ignore. A consumer backlash is what keeps them in check.
Rating: 10 Votes
Avatar
PBG4 Dude
15 months ago

Backdrop-filter is a CSS property that allows you to create for example the background blur effect you know from iOS / macOS. You know, there is a window and the windows behind that window are blurred. It uses a lot of GPU. If you create a lot of elements with this property, Safari starts freezing. But it's not security bug. If your website causes this kind of problem, people won't be visiting it and you are the only one who has some kind of "damage" because of that. I think you can freeze browser using JavaScript, if you run a badly written function. But why would you do that?

Because, a crash is the starting point of an exploit. If you can get it to run some arbitrary code right at or after the point of crash, maybe you can make the system do something it normally wouldn’t, or shouldn’t do.
Rating: 5 Votes
Avatar
Markoth
15 months ago

It needs to be done. That’s how you keep big companies from brushing things under the carpet.
There are plenty of exploits Apple and others have ignored and continue to ignore. A consumer backlash is what keeps them in check.

Actually, this is highly improper. Generally-speaking, you inform companies a good bit prior to going live with the info, so that they have time to patch it first. If you care about those affected by this, it's the only right thing to do. This obviously hasn't been patched yet, so now millions out there are vulnerable, and anyone with enough experience can exploit it.
Rating: 3 Votes
Avatar
69Mustang
15 months ago

Actually, this is highly improper. Generally-speaking, you inform companies a good bit prior to going live with the info, so that they have time to patch it first. If you care about those affected by this, it's the only right thing to do. This obviously hasn't been patched yet, so now millions out there are vulnerable, and anyone with enough experience can exploit it.

This is more a nuisance bug, like the Telugu character. It's not a security bug. What exactly are millions vulnerable to, annoyance?
Rating: 2 Votes
Avatar
MacSince1985
15 months ago
Unfortunately, he gives enough details for people to try exploiting the bug themselves.
Rating: 2 Votes
Avatar
gaximus
15 months ago

Because, a crash is the starting point of an exploit. If you can get it to run some arbitrary code right at or after the point of crash, maybe you can make the system do something it normally wouldn’t, or shouldn’t do.


No its not. "Getting it to run some arbitrary code", is the starting point of an exploit. in fact the crash would stop any kind of exploit because the system is down, as in can't run anymore code.
Rating: 2 Votes
Avatar
TMRJIJ
15 months ago

Funny, I posted about this earlier and you folks are just NOW writing an article!

Ask MR for some cred, bruh...
Rating: 1 Votes
Avatar
bluecoast
15 months ago
This could be a plot element in Groundhog Day 2
Rating: 1 Votes
Avatar
timeconsumer
15 months ago

Funny, I posted about this earlier and you folks are just NOW writing an article!

Did you try submitting this to them?

Can contact them here: https://www.macrumors.com/share.php
Rating: 1 Votes
Avatar
69Mustang
15 months ago

Doesn't matter. This should have been reported to Apple first. Oftentimes, glitches like these can lead to tangible security vulnerabilities. We don't know exactly what's going wrong internally to cause this crash. If whatever it is is something which can be exploited to do something worse, then you will have seen my point. Bugs this critical should be reported immediately.

Outside of you making the suggestion, there's nothing that remotely linking this bug to anything but being annoying. Glitches can lead to security vulnerabilities. They can also just be annoying glitches. It's not critical. The researcher reported it to Apple. Apple's response to the bug demonstrates the level of "critical" it carries. There doesn't seem to be a sense of urgency by anyone involved with this.
Rating: 1 Votes
[ Read All Comments ]