iPhone owners would be forgiven for having a false sense of security when it comes to the safety of data on their phone. Apple has done a tremendous job of creating a locked-down operating system that keeps malicious software away from its elegant handsets and deters potential attackers.
Android continues to be the most targeted mobile operating system. Cisco’s 2014 Annual Security Report claimed that 99% of mobile malware spotted in 2013 was aimed at Google’s smartphone operating system – the report was swiftly
tweeted by Apple’s Phil Schiller as his latest jab at Android.
Yet there remain some alarming facts for iPhone owners to take on board. First, its iOS software is far from flaw-free. In a 2013 report, Symantec claimed that there were
387 documented security holes in iOS in 2012, compared to just 13 for Android.
When Apple released its iOS 7 software in 2013, it patched a whopping 70 flaws. And while vulnerabilities do not always equate to threats, it’s clear from this data that iOS is far from invincible. What’s more, there are a myriad of ways outsiders can try to pilfer data from iOS. Given the popularity of Apple’s devices, attackers will be hungry to exploit them.
Target the apps
If you’ve been reading the Guardian’s coverage of online surveillance by agencies including the NSA and GCHQ, you’ll already know that one way to gather data from smartphones is to exploit vulnerabilities in apps. A variety of techniques can be employed by attackers in this respect.
One notable problem uncovered by an Israeli start-up, SkyCure, was the insecure use of what’s known as the
“301 Moved Permanently” HTTP feature found in many applications on iOS, which lets developers easily switch the Internet addresses apps use to acquire data. It’s often used when services are switching domains.
SkyCure found attackers sitting on the same network as a user of a vulnerable app could easily switch those Internet addresses with their own malicious site. Even when users left that network, as iOS cached the malicious URL, when they continued to use the application they would still hit that bad site, which could be used to carry out exploits on the user’s phone.
At least three of the biggest US media outlets had such a flaw in their consumer-facing applications, says Yair Amit, co-founder and chief technology officer of Skycure. “You can persistently and remotely control how the application is working,” he warns.
“It’s possible because most applications are loading information or commands from their server to execute on the client with no indication of the actual source. I’ve been working with many pretty well-known papers as well as other big vendors on other applications, like finance and podcasts, and patches are going out.”
Amit is planning to detail some more “neat techniques” for exploiting iOS at the
RSA Conference in San Francisco this month, but cannot reveal more as he works with Apple to mitigate the threat.
Insecure data
Developers, whether producing iOS applications for workers or for the wider public, often rely too heavily on the device to store data too. If done insecurely, this allows attackers sitting on the same network as an iPhone user, such as a public Wi-Fi network, to potentially scoop up information being sent to and from the app.
“It is easy to make mistakes such as storing user data (passwords/usernames) incorrectly on the device, in the vast majority of cases credentials get stored either unencrypted or have been encoded using methods such as base64 encoding (or others) and are rather trivial to reverse,” says Andy Swift, mobile security researcher from penetration testing firm Hut3.
“This mistake extends to sending data too, if developers rely on the device too much it becomes quite easy to forget altogether about the transmission of the data. Such data can be easily extracted and may include authentication tokens, raw authentication data or personal data. At the end of the day if not investigated, the end user has no idea what data the application is accessing and sending to a server somewhere.”
Another common problem in iOS apps, according to Cesar Cerrudo, chief technology officer for security research and consultancy firm IOActive Labs, is improper or lack of validation of data received by the application. This allows attackers to send malicious data to the app and have malicious code executed on the user device to steal information.
All of these attacks could easily be executed on public or unprotected Wi-Fi networks, so you should be especially careful when using such services, refraining from sharing sensitive data over them. And they should avoid any untrusted networks.
Using stolen certificates
Apple has been particularly good at defending iPhones and iPads from malware. Yet there are ways to game the system to get rogue apps on iOS devices.
Stolen certificates can be particularly handy. Even though they can be tricky to acquire, some are bought and sold on underground forums, others nabbed during attacks on businesses. These certificates are designed to sign applications, providing validation they were created by legitimate parties.
For iOS, they come in various flavours, the most common one being for developers who want to publish on the official App Store. But there are also certificates for signing in-house applications, where IT teams send out apps and updates via their own infrastructure, rather than using the App Store.
If an attacker can get hold of a valid certificate, they can target specific employees by enticing them into downloading malicious applications, as Michael Shaulov, chief executive of San Francisco-based firm Lacoon Mobile Security demonstrates during a one-on-one presentation over WebEx.
He shows me a mock phishing email, urging a user to download a security update. When the user clicks on the download link, they are asked by the device whether they want to install. If they click yes, as many would do if the email appeared to legitimately come from their employer, the malware downloads on to the iPhone.
In the example Shaulov uses, a fake enterprise email client is downloaded. He uses that fake app to collect information such as calendar, geolocation and contact data, or even switch on recording without any user intervention. “This is all done on a completely fresh iOS 7 non-jailbroken device. You can facilitate such an attack without much effort,” he adds.
“A lot of enterprises are now ahead of the curve with their mobility and are distributing in-house applications in such a way that it becomes a very reasonable phishing target. People are familiar with this way that IT delivers a new application, so they just click that malicious link.”
Bypassing App Store protections
Whilst using stolen certificates is handy for targeted hits where the hackers want to avoid all the code checking that the App Store provides, the holy grail for iOS attackers is getting malware into Apple’s walled garden - the official App Store, which has
only ever hosted one rogue app.
Given Apple doesn’t allow anti-virus to work on its mobile machines, acquiring masses of malware downloads from its official market would be a major coup for a digital criminal.
There are precedents. Researchers from the
Georgia Tech Information Security Center have previously shown off a way of sneaking a bad app into the store. They sent in what appeared to be a legitimate piece of software and Apple accepted it. But once the app was installed on a user device it would rearrange its code to enable more malicious features, such as stealing photos and sending emails.
Others have created nifty pieces of iOS malware. Neal Hindocha, a researcher from security company Trustwave, is
planning to demonstrate a keylogger at RSA Conference that can monitor everything on an iPhone, right down to the swipes of a touchscreen. It will only work on a jailbroken device, however, where security protections stopping applications having too much power are removed.
Jailbreaking and jumping out of the sandbox
Another potentially nasty attack vector can come from website attacks that launch a kernel-level exploit, cutting right to the heart of iOS and handing user privileges to a hacker. This is one of the most difficult ways to break iOS, especially when the attacker is doing the work remotely rather than having direct access to the device.
Apple has covered off all known kernel vulnerabilities in the latest version of iOS, but researchers have theorised on possible future attacks. Tarjei Mandt, senior vulnerability researcher at Azimuth Security, has been
probing the ways iOS allocates memory and believes he has found a potential weakness.
It lies in what is known as the new “zone page metadata structure”, which is designed to improve the performance of the operating system’s zone allocator, used for organising memory by size, dividing memory into regions, or zones.
A hypothetical attack would see the hacker trick this metadata structure, information from which is taken by the code doing the memory allocation, into writing remote code into the memory pages of the device.
“If you have a memory corruption vulnerability, the idea [for the attacker] is that you can target this structure to overwrite the information that it contains,” he says. “If you have the ability to corrupt that data structure… you’ll essentially be able to gain an arbitrary right [a privilege allowing an attacker to write to the device], which is pretty much the end goal of any exploit.”
The attacker could direct a target to a website, where a browser vulnerability would be exploited to initiate attack code. The kernel flaw would then be used to jump out of the Apple sandbox, an emulation technology that runs code to see if it’s malicious before executing it. In theory, this chained approach would eventually lead to malicious software being lumped on the iPhone.
Another way of getting root access to a phone is to jailbreak it by physically grabbing it and using known tools like evasi0n, which requires the iPhone be connected to a PC by USB, to gain user privileges. Malware could then be installed for persistent attacks.
Lacoon has data showing that iOS is the favourite target of those running spyphones, buyable software that does what it says on the tin, monitoring jailbroken devices. In an
analysis of 650,000 users from a major telecoms partner, Lacoon found 57% of the 650 infected machines were based on iOS.
If all this sounds worrying, there’s one encouraging piece of advice: the best strategy for the average iPhone owner is quite simple: keep your device within your line of sight, and don’t click on any suspicious links.
