Apple iOS 7.0.2 – Sim Lock Screen Display Bypass

Exploit Database
119 阅读

作者： Vulnerability-Lab

日期： 2013-10-15
类别：
- webapps
平台：
- ios
来源：https://www.exploit-db.com/exploits/28978/

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

Document Title:

===============

Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability

References (Source):

====================

http://www.vulnerability-lab.com/get_content.php?id=1105

Video: http://www.vulnerability-lab.com/get_content.php?id=1104

Release Date:

=============

2013-10-04

Vulnerability Laboratory ID (VL-ID):

====================================

1105

Common Vulnerability Scoring System:

====================================

6.1

Product & Service Introduction:

===============================

iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally unveiled in 2007

for the iPhone, it has been extended to support other Apple devices such as the iPod Touch (September 2007), iPad (January 2010),

iPad Mini (November 2012) and second-generation Apple TV (September 2010). Unlike Microsoft<code>s Windows Phone and Google</code>s Android,

Apple does not license iOS for installation on non-Apple hardware. As of August 2013, Apple<code>s App Store contained more than 900,000

iOS applications, 375,000 of which were optimised for iPad. These apps have collectively been downloaded more than 50 billion times.

It had a 21% share of the smartphone mobile operating system units shipped in the fourth quarter of 2012, behind only Google</code>s Android.

In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod Touch and the iPad).[8] At the half

of 2012, there were 410 million devices activated. According to the special media event held by Apple on September 12, 2012, 400 million

devices had been sold by June 2012.

The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements consist

of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch, all of which

have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal accelerometers are used

by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three dimensions (one

common result is switching from portrait to landscape mode. iOS is derived from OS X, with which it shares the Darwin foundation and

various application frameworks. iOS is Apple<code>s mobile version of the OS X operating system used on Apple computers.

Major versions of iOS are released annually. The current release, iOS 7, was released on September 18, 2013. In iOS, there are four

abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The current version of the

operating system (iOS 7.0.2), dedicates 1–1.5 GB of the device</code>s flash memory for the system partition, using roughly 800 MB of that

partition (varying by model) for iOS itself.

(Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )

Abstract Advisory Information:

==============================

The Vulnerability Laboratory Research Team discovered a local bypass vulnerability in the official Apple iOS v7.0.1 Mobile.

Vulnerability Disclosure Timeline:

==================================

2013-04-10: Public Disclosure (Vulnerability Laboratory)

Discovery Status:

=================

Published

Affected Product(s):

====================

Apple

Product: iOS 7.0.1

Apple

Product: iOS 7.0.2

Exploitation Technique:

=======================

Local

Severity Level:

===============

High

Technical Details & Description:

================================

A restricted screen bypass via design glitch is detected in the official Apple iOS v7.0.1 for Mobile Devices (iPad|iPhone).

The security vulnerability allows local attackers to bypass the display screen of the restricted sim locked mode.

The bypass vulnerability is located in the iOS v7.0.1/7.0.2 when the <code>sim locked</code> mode of an iphone mobile is activated.

Local attackers can redirect the sim locked display to the regular default mode by using a restricted calculator function in

combination with the shutdown and unlock button. As result the local attacker is able to glitch > jump into the regular locked

phone mode with calender + hyperlinks, camera and control center. The regular sim locked display is at the end usable like in

the regular mode without sim locked label in the screen.

The local sim lock screen display bypass vulnerability can be exploited by local attackers with physical device access and without

user interaction. Successful exploitation results in the bypass of the sim lock mode to the regular lock mode. In a earlier test (7.x)

we combined the earlier discovered issues to first unlock the sim display (locked sim card) and bypass the pass code to fully compromise.

Proof of Concept (PoC):

=======================

The local vulnerability can be exploited by local attackers with physical device access and without user interaction.

For demonstration or reproduce ...

Manual reproduce like in the iphone poc security video ...

1.Start your iPhone and ensure you have the iOS v7.0.1 installed

2.Activate the Sim Lock mode

3.Start the device new and you will see a black notification in the middle of the display (sim locked)

Note: Sometimes the message also comes up in the restricted mode with a grey message box in the middle of the display.

4.Open the calender, and scroll down to the two hyper links

5.Press the power button and wait 2 secounds in the last secound your press one of the two hyperlinks

6.You get redirected via hyperlink because of the restriction to the pass code sim lock

7.Press again 3 secound the power button and push at the end in the last secound the home button

8.Click cancel again in the shutdown menu but hold the home button

9.Open up the control center and go to the calculator. Now a message box appears automatically with the sim lock entry button or the ok cancel

10. Press 3 secounds the shutdown button and in the last secound you press the unlock or ok button and hold home

Note: The pass code module comes up but some milisecounds after it there is an automatic redirect to the earlier opened module (calculator)

11. Now the attacker only press one time 3 secounds the power button again and when its opened he press cancel and one time the home button

12. The locked screen disappears and the restricted screen display mode has been bypassed.

Video PoC: https://www.youtube.com/watch?v=6_e-hvglQdg

Solution - Fix & Patch:

=======================

7.0.3 ?!

Security Risk:

==============

The security risk of the local sim lock display screen bypass vulnerability is estimated as medium(+)|(-)high.

Credits & Authors:

==================

Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@evolution-sec.com) [www.vulnerability-lab.com]

Disclaimer & Information:

=========================

The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties,

either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-

Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business

profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some

states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation

may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases

or trade with fraud/stolen material.

Domains:www.vulnerability-lab.com - www.vuln-lab.com - www.evolution-sec.com

Contact:admin@vulnerability-lab.com - research@vulnerability-lab.com - admin@evolution-sec.com

Section:www.vulnerability-lab.com/dev - forum.vulnerability-db.com - magazine.vulnerability-db.com

Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab

Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory.

Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other

media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and

other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed),

modify, use or edit our material contact (admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

VULNERABILITY LABORATORY RESEARCH TEAM

DOMAIN: www.vulnerability-lab.com

CONTACT: research@vulnerability-lab.com