AirDoS: An iOS bug in AirDrop let anyone temporarily lock-up nearby iPhones

guest · Dec 12, 2019

An iOS bug in AirDrop let anyone temporarily lock-up nearby iPhones
December 10, 2019
https://techcrunch.com/2019/12/10/ios-airdrop-lock-up-iphones/

Apple has fixed a bug in iOS 13.3, out today, which let anyone temporarily lock users out of their iPhones and iPads by forcing their devices into an inescapable loop.

Kishan Bagaria found a bug in AirDrop, which allows users to share files between iOS devices. He found the bug let him repeatedly send files to all devices able to accept files within wireless range of an attacker.
When a file is received, iOS blocks the display until the file is accepted or rejected. But because iOS didn’t limit the number of file requests a device can accept, an attacker can simply keep sending files again and again, repeatedly displaying the file accept box, which causes the device to get stuck in a loop.

The only other way to stop an attack? “Simply run away,” he said. Once a user is out of wireless range of the attacker, they can turn off Bluetooth.
Apple fixed the bug by adding a rate-limit that prevents a barrage of requests over a short period of time.
Click to expand...

AirDoS: Remotely render any nearby iPhone or iPad unusable

What if you could walk into a room and make every* iPhone or iPad unusable while you're there? Wait, that sounds evil. What if you could get that one annoying person off their iPhone who's always on it?

*This bug is still subject to the AirDrop receiving setting, meaning if your AirDrop setting is set to "Everyone", anyone can be the attacker, but if it's set to "Contacts Only", only someone in your contacts can be the attacker.
I've posted my PoC exploit on GitHub. It supports multiple devices but deliberately doesn't support devices that have their AirDrop receiving setting set to "Contacts Only" to reduce the impact of publicly posting the exploit.
Click to expand...

Log in or Sign up

AirDoS: An iOS bug in AirDrop let anyone temporarily lock-up nearby iPhones

guest Guest

Log in or Sign up

AirDoS: An iOS bug in AirDrop let anyone temporarily lock-up nearby iPhones

guest Guest

Useful Searches