Connect with us

Hi, what are you looking for?

Technology

Apple fixes doorLock bug that can disable iPhones and iPads

Apple logo


Apple fixes doorLock bug that can disable iPhones and iPads

Apple has released security updates to address a persistent denial of service (DoS) dubbed doorLock that would altogether disable iPhones and iPads running HomeKit on iOS 14.7 and later.

HomeKit is an Apple protocol and framework that allow iOS and iPadOS users to discover and control smart home appliances on their network.

As the company explained in a security advisory issued today, the doorLock vulnerability tracked as CVE-2022-22588 will crash affected iOS and iPadOS devices when processing maliciously crafted HomeKit accessory names.

Apple has addressed this severe resource exhaustion issue in iOS 15.2.1 and iPadOS 15.2.1 by adding improved input validation which no longer allows attackers to disable vulnerable devices.

Devices that received security updates today include iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).

“Four months ago I discovered and reported a serious denial of service bug in iOS that still remains in the latest release. It persists through reboots and can trigger after restores under certain conditions,” Trevor Spiniolas, the programmer and “beginning security researcher” who spotted and reported the bug.

“All the requirements are default settings. When someone sets up their iOS device, everything is already in order for the bug to work. If they accept a malicious home invitation from there, their device stops working.”

Advertisement. Scroll to continue reading.

Fix delayed since August

According to Spiniolas, Apple has known about doorLock since August 2021, 2021, but pushed the security update multiple times despite repeatedly promising to fix it.

“I believe this bug is being handled inappropriately as it poses a serious risk to users and many months have passed without a comprehensive fix,” Spinolas said.

“The public should be aware of this vulnerability and how to prevent it from being exploited, rather than being kept in the dark.”

The researcher says attackers would have to change the name of a HomeKit device to large strings of up to 500,000 characters and trick the target into accepting a Home invitation.

Once the target joins the attacker’s HomeKit network, their device becomes unresponsive and eventually crashes.

The only way to recover from such an attack would be to factory reset the disabled device, given that it will once again crash after restarting and signing back into the iCloud account linked to the HomeKit device.

Zero-day patches also delayed

In September, software developer Denis Tokarev also dropped proof-of-concept exploit code for three iOS zero-day flaws on GitHub after Apple delayed patching and failed to credit him when patching a fourth in July.

One month later, with the release of iOS 15.0.2, Apple fixed one of the ‘gamed’ zero-day vulnerabilities reported by Tokarev.

Advertisement. Scroll to continue reading.

However, Apple didn’t acknowledge or credit him for the discovery and also asked him to keep quiet and not disclose to others that the company failed to give him credit for the bug.

Other security researchers and bug bounty hunters have also gone through similar experiences saying that they have been kept in the dark for months on end with Apple refusing to reply to their messages.





Source link

Click to comment

Leave a Reply

Latest

Top Stories

UNI needs to break above a key technical resistance level to trigger its 100% bull run scenario. Otherwise, a bear flag awaits a 45%...

Technology

We are excited to bring Transform 2022 back in-person July 19 and virtually July 20 – 28. Join AI and data leaders for insightful...

Top Stories

The provision in the U.S. infrastructure bill signed into law in November, which will require financial institutions and crypto brokers to report additional information,...

Social Media

As it looks to add more ways to help creators to build their presence, and monetize their work in the app, Facebook is launching...

Technology

In context: Tensor cores have been one of the main advantages of Nvidia’s RTX graphics cards, enabling machine learning-based image upscaling, which significantly improves...

Online Business Success

Small Town Cultures pickles. Small Town Cultures Small Town Cultures A family-based fermentation company located in upstate New York, bring simple, clean fermented foods...

Advertisement

You May Also Like

Uncategorized

Introductions get a lot of attention. I’ve explored the topic of how to write them even though as a reader, I always skip them....

Online Business Success

The internet is now our nervous system. We are constantly streaming and buying and watching and liking, our brains locked into the global information...

SEO Guide

There are all kinds of pictures of the world on the internet, but to find one of these specific pictures that you want to...

Online Business Success

You can think of link building in many ways. I like to call it tedious, painful, and a test of patience. It’s also necessary...

Advertisement