Apple's iOS Contacts app claimed to be vulnerable to SQLite hack

guest · Aug 10, 2019

Apple's iOS Contacts app claimed to be vulnerable to SQLite hack
August 10, 2019
https://appleinsider.com/articles/1...s-app-claimed-to-be-vulnerable-to-sqlite-hack

Security firm Check Point has demonstrated a vulnerability in the industry-standard SQLite database format which can be exploited. Speaking at Def Con 2019, the company showed the technique being used to manipulate Apple's iOS Contacts app. Searching the Contacts app under these circumstances can be enough to make the device run malicious code.

"SQLite is the most wides-spread database engine in the world," said the company in a statement. "It is available in every operating system, desktop and mobile phone. Windows 10, macOS, iOS, Chrome, Safari, Firefox and Android are popular users of SQLite."

Documented In a 4,000-word report seen by AppleInsider, the company's hack involved replacing one part of Apple's Contacts app and it also relied on a known bug that has hasn't been fixed four years after it was discovered.

"This feature was only ever considered vulnerable in the context of a program that allows arbitrary SQL from an untrusted source and so it was mitigated accordingly. However, SQLite usage is so versatile that we can actually still trigger it in many scenarios."
However, Check Point's researchers then managed to make a trusted app send the code to trigger this bug and exploit it.
Click to expand...

guest · Aug 11, 2019

mood said: ↑

Apple's iOS Contacts app claimed to be vulnerable to SQLite hack
August 10, 2019
https://appleinsider.com/articles/1...s-app-claimed-to-be-vulnerable-to-sqlite-hack
Click to expand...

Check Point: Gaining code execution using a malicious SQLite database

iOS Persistency
Persistency is hard to achieve on iOS as all executable files must be signed as part of Apple’s Secure Boot. Luckily for us, SQLite databases are not signed.
Utilizing our new capabilities, we will replace one of the commonly used databases with a malicious version. After the device reboots and our malicious database is queried, we gain code execution.
Conclusion
As our permissions hierarchies become more segmented than ever, it is clear that we must rethink the boundaries of trusted/untrusted SQL input. To demonstrate these concepts, we achieved remote code execution on a password stealer backend running PHP7 and gained persistency with higher privileges on iOS. We believe that these are just a couple of use cases in the endless landscape of SQLite.
Click to expand...

Warning Issued For Apple's 1.4 Billion iPad And iPhone Users
August 10, 2019
https://www.forbes.com/sites/gordon...curity-warning-ios-12-ios13-iphone-xs-max-xr/

Picked up by AppleInsider, security firm Check Point has revealed it has found a way to hack every iPhone and iPad running iOS 8 right up to betas of iOS 13. This spread covers eight years of devices (iOS 8 supports the 2011 iPhone 4S) and, with Tim Cook stating there are 1.4BN active iOS devices around the world, this is worrying news for the owners of pretty much all of them.

But the real shocker is why the Contacts app vulnerability exists in the first place: it capitalises on a known bug which Apple has failed to fix for four years.
All of which puts Apple in an uncomfortable situation. The company has long touted security as a major selling point over rivals, but the holes keep coming and when this one comes off the back of four years of inaction, it’s not a good look.

Your move, Apple.
Click to expand...

The Hammer · Aug 12, 2019

Hopefully they (Apple) get something done now.

Log in or Sign up

Apple's iOS Contacts app claimed to be vulnerable to SQLite hack

guest Guest

guest Guest

The Hammer Registered Member

Log in or Sign up

Apple's iOS Contacts app claimed to be vulnerable to SQLite hack

guest Guest

guest Guest

The Hammer Registered Member

Useful Searches