iOS Wi-Fi Exploit Could Have Let Hackers Remotely Access Nearby iPhones

Earlier this year, Apple patched an iOS vulnerability that potentially could have allowed hackers to remotely access a nearby iPhone and gain control of the entire device.

awdl ios hack beer
Devised by Ian Beer, a researcher at Project Zero, Google's vulnerability research team, the exploit used a vulnerability in Apple Wireless Direct Link (AWDL), Apple's proprietary mesh networking protocol that enables features like AirDrop and Sidecar to work.

Beer revealed the stunning exploit on Tuesday in a 30,000-word blog post, which shows in detail how a memory corruption bug in AWDL could give attackers remote access to a user's personal data, including emails, photos, messages, and passwords and crypto keys stored in the keychain.

The vulnerability was discovered by Beer in a 2018 iOS beta that Apple accidentally shipped without stripping function name symbols from the kernelcache, offering a wealth of missing context about how bits of code fit together.

After lengthy investigative work, Beer was able to find code related to AWDL, identify the vulnerability, and target it remotely using a laptop, a Raspberry Pi 4B and a couple of Wi-Fi adapters.

It took six months for Beer to develop the exploit, but by the time he was finished he was able to hack any ‌iPhone‌ that was in radio proximity, run arbitrary code on it, and steal all the user data.

Beer says he has no evidence that the issues he uncovered were exploited in the wild, but "we do know that exploit vendors seem to take notice of these fixes."

The takeaway from this project should not be: no one will spend six months of their life just to hack my phone, I'm fine.

Instead, it should be: one person, working alone in their bedroom, was able to build a capability which would allow them to seriously compromise iPhone users they'd come into close contact with.

Imagine the sense of power an attacker with such a capability must feel. As we all pour more and more of our souls into these devices, an attacker can gain a treasure trove of information on an unsuspecting target.

Apple patched the vulnerability in May with the release of iOS 12.4.7 and iOS 13.3.1, and actually cites Beer in changelogs for several security updates. Apple said that the vast majority of users are already on newer versions of iOS that have been patched.

Tag: Exploit

Top Rated Comments

haruhiko Avatar
19 months ago
For the people who never updates their phones, please take note.
Score: 31 Votes (Like | Disagree)
kstotlani Avatar
19 months ago

At least 99% of the iPhone users can update to the latest version with all the critical fixes if they want. Most Android users have to get a new phone to get the latest OS updates.
There was an interesting conversation between Joe Rogan and Snowden. Snowden mentioned that Android’s fragmentation makes it difficult for hackers because there are so many versions across thousands of different devices. It’s hard to concentrate and develop exploits for such variety. Hackers would rather concentrate on devices like iPhones where there is likelihood of more devices with the same version of the OS. Makes sense doesn’t it?
Score: 12 Votes (Like | Disagree)
Mettwurst Avatar
19 months ago
"Even faster on the new Apple M1 Macbook Air"
Score: 10 Votes (Like | Disagree)
m.x Avatar
19 months ago

This was fixed in iOS 12.4.7. The latest iOS 12 version is iOS 12.4.9. It can be installed on an iPhone 5s, iPhone 6, and iPhone 6+. All later phones, starting with iPhone 6s, can run iOS 13 and iOS 14, which also fix the problem.
Simply using iOS 13 does not fix the problem - he demonstrates the attack using an iPhone 11 Pro on iOS 13.2. You need iOS 13.3.1 as it was patched there. It‘s a bit nitpicky but this information is missing in the Macrumors article as someone might think „oh, I’m running iOS 13.1 so I’m not affected“.
Score: 7 Votes (Like | Disagree)
0815 Avatar
19 months ago
At least 99% of the iPhone users can update to the latest version with all the critical fixes if they want. Most Android users have to get a new phone to get the latest OS updates.
Score: 7 Votes (Like | Disagree)
vionc Avatar
19 months ago
That is really impressive. Kudos to Ian Beer!
Score: 5 Votes (Like | Disagree)

Related Stories

appleprivacyad cleaned

iOS 15 Patched Security Hole That Potentially Exposed Users' Private Apple ID Information to Third-Party Apps

Thursday January 20, 2022 3:32 am PST by
Apple patched two significant security vulnerabilities when it released iOS 15 that could have potentially exposed users' private Apple ID information and in-app search history to malicious third-party apps and allowed apps to override user Privacy preferences, Apple has revealed in a recent support document update. With most iOS, macOS, tvOS, and watchOS updates, Apple provides a list of...
apple security banner

Apple Reportedly Notified Some U.S. State Department Employees They May Have Been Targeted by NSO Group Spyware

Friday December 3, 2021 8:56 am PST by
Apple has notified at least nine U.S. Department of State employees that they may have been targeted by state-sponsored spyware created by Israeli company NSO Group, according to a Reuters report citing four people familiar with the matter. A spokesperson for NSO Group told Reuters that it will investigate and take legal action against customers using its tools illegally if necessary."If our ...
apple releases ios 14 7

Alert: Update to iOS 14.7 Now to Protect Against Dangerous Wi-Fi Bug

Wednesday July 21, 2021 4:13 am PDT by
iPhone users should upgrade to iOS 14.7 immediately to avoid a dangerous bug that disabled the device's Wi-Fi, sometimes irreversibly. Before iOS 14.7, if a user connected to a Wi-Fi network with the name "%p%s%s%s%s%n," a bug completely disabled the device's ability to connect to Wi-Fi. According to user reports, doing so would "permanently disable" an iPhone's Wi-Fi functionality, making...
iPhone 13 Security

Researcher Says Apple Ignored Three Zero-Day Security Vulnerabilities Still Present in iOS 15

Friday September 24, 2021 10:42 am PDT by
In 2019, Apple opened its Security Bounty Program to the public, offering payouts up to $1 million to researchers who share critical iOS, iPadOS, macOS, tvOS, or watchOS security vulnerabilities with Apple, including the techniques used to exploit them. The program is designed to help Apple keep its software platforms as safe as possible. In the time since, reports have surfaced indicating...
safari icon blue banner

macOS Monterey 12.2 and iOS 15.3 Release Candidates Fix Safari Bug That Leaks Browsing Activity

Thursday January 20, 2022 1:30 pm PST by
The macOS Monterey 12.2 and iOS 15.3 release candidates that came out today appear to address a Safari bug that could cause your recent browsing history and details about your identity to be leaked to malicious entities. As shared last week by browser fingerprinting service FingerprintJS, there is an issue with the WebKit implementation of the IndexedDB JavaScript API. Any website that uses...
sengled tv light strip

CES 2022: Sengled Debuts New Smart TV Light Strips and Outdoor String Lights

Monday January 3, 2022 8:02 am PST by
Lighting company Sengled today announced the launch of several new smart lighting products, including Wi-Fi Video-Sync TV Light Strips, Wi-Fi Outdoor String Lights, and the Wi-Fi Portable Lamp. The WiFi TV Light Strips are designed to extend what's showing on the television set to the wall behind it for a more immersive entertainment experience. The lights are designed to react to content...
iOS 14 vs 15 feature

Apple More Aggressively Pushing iOS 14 Users to Upgrade to iOS 15

Thursday January 13, 2022 10:37 am PST by
Apple is encouraging people who are still running iOS 14 to update to iOS 15, a reversal of an earlier policy that saw the company allowing iOS 14 users to choose not to install the iOS 15 update. When iOS 15 launched, Apple said that iOS offered a "choice between two software update versions," pledging to offer security updates for those who opted to stick with iOS 14.iOS now offers a...
General iOS 14

iOS 14.7.1 and macOS Big Sur 11.5.1 Patch Security Vulnerability That May Have Been Actively Exploited

Monday July 26, 2021 11:55 am PDT by
Apple today released unexpected iOS 14.7.1 and iPadOS 14.7.1 updates to the public, and according to a newly released support document, the software addresses a serious security vulnerability that may have been exploited in the wild. Apple says that an application may have been able to execute arbitrary code with kernel privileges due to a memory corruption issue. "Apple is aware of a report ...

Popular Stories

maxresdefault

Unbox Therapy Shares Hands-On Look at iPhone 14 Pro Max Replica

Monday May 16, 2022 4:40 am PDT by
YouTuber Unbox Therapy has shared a hands-on look at the iPhone 14 Pro Max using what he claims is a one-to-one replica created by third-party case makers with access to detailed schematics and dimensions for Apple's new upcoming flagship smartphone. As with the iPhone 13 Pro lineup, in 2022, we are expecting a 6.1-inch iPhone 14 Pro and a 6.7-inch iPhone 14 Pro Max, but this time the Pro...
macOS Monterey 2

Apple Releases macOS Monterey 12.4 With Support for Studio Display Webcam Update

Monday May 16, 2022 10:10 am PDT by
Apple today released macOS Monterey 12.4, the fourth major update to the macOS Monterey operating system that launched in October 2021. macOS Monterey 12.4 comes over two months after the launch of macOS Monterey 12.3, an update that added Universal Control. The ‌‌‌‌‌macOS Monterey‌‌ 12.4 update can be downloaded on all eligible Macs using the Software Update section of System...
iOS 15

Apple Releases iOS 15.5 and iPadOS 15.5 With Wallet and Podcast Updates

Monday May 16, 2022 10:00 am PDT by
Apple today released iOS 15.5 and iPadOS 15.5, the fifth major updates to the iOS and iPadOS 15 operating systems that were initially released in September 2021. iOS and iPadOS 15.5 come a little over two months after the launch of iOS 15.4 and iPadOS 15.4. The iOS 15.5 and iPadOS 15.5 updates can be downloaded for free and the software is available on all eligible devices over-the-air in...
iOS 16 mock for article

Gurman: iOS 16 to Include New Ways of System Interaction and 'Fresh Apple Apps'

Sunday May 15, 2022 6:14 am PDT by
iOS 16 will include new ways of interacting with the system and some "fresh Apple apps," Bloomberg's Mark Gurman has said, offering some more detail on what Apple has in store for the upcoming release of iOS and iPadOS set to be announced in a few weeks at WWDC. In the latest edition of his Power On newsletter, Gurman wrote that while iOS 16 is not likely to introduce a major face-lift to...
Prosser Series 8 3

Apple Watch Series 8 Rumored to Feature New Design With Flat Display

Wednesday May 18, 2022 6:21 am PDT by
The Apple Watch Series 8 could feature an all-new design with a flat display, according to the leaker known as "ShrimpApplePro." In his latest video on the YouTube channel Front Page Tech, Jon Prosser highlighted information from ShrimpApplePro that suggests the Apple Watch Series 8 could feature a flat display in what seems to be a design originally rumored for the Apple Watch Series 7. ...
Whatsapp Feature

WhatsApp to Let Users Leave Group Chats 'Silently' and View Rich Link Previews in Status Updates

Tuesday May 17, 2022 3:07 am PDT by
WhatsApp is working on a new feature that will allow users to "silently" leave group chats hosted by the messaging platform instead of all members of the group being notified when they do. As it stands, when someone leaves a group chat, WhatsApp announces their exit to the entire group, making the act of leaving very public. It's not possible right now to leave a group quietly, but WhatsApp...
apple tv 4k design green

Apple Releases tvOS 15.5 for Apple TV HD and Apple TV 4K

Monday May 16, 2022 9:57 am PDT by
Apple today released tvOS 15.5, the fifth major update to the tvOS operating system that first launched in September 2021. tvOS 15.5 comes more than two months after the release of tvOS 15.4, an update that brought support for captive WiFi networks. tvOS 15.5 can be downloaded over the air on the Apple TV through the Settings app by going to System > Software Update. ‌‌‌‌‌‌Apple...