Threat actors can simulate iPhone reboots and keep iOS malware on a device

guest · Jan 5, 2022

January 5, 2022

In a piece of groundbreaking research published on Tuesday night, security firm ZecOps said that it found a way to block and then simulate an iOS restart operation, a technique that they believe could be extremely useful to attackers who may want to trick users into thinking they rebooted their device and as a result, maintain access for their malware on that infected system.

Because of this, today, most iOS malware strains focus on infecting a device, gaining root access, and harvesting and spying on the user until victims restart their iPhones and iPads, after which the attacker tries to infect the victim again.

And some more generic iOS security tips: reboot your device daily, to remove non-persistent implants. Create regular iTunes backups, to check them later for signs of compromise. Trigger sysdiags regularly and save them.
— Costin Raiu (@craiu) September 14, 2021
Click to expand...

ZecOps presents new NoReboot technique
But in a blog post on Tuesday, ZecOps said that the iOS restart process isn’t immune to being hijacked once an attacker has gained access to a device.

The researchers said they developed a technique they called NoReboot that taps into SpringBoard (the Apple iOS UI app, aka the Home Screen) and Backboardd (the daemon behind SpringBoard) to detect and intercept a phone restart command (such as pressing the Volume Down + Power buttons) and then disabling the SpringBoard UI instead of shutting down the entire OS.
Click to expand...

ZecOps: Persistence without “Persistence”: Meet The Ultimate Persistence Bug – “NoReboot”

Meet “NoReboot”: The Ultimate Persistence Bug
We’ll dissect the iOS system and show how it’s possible to alter a shutdown event, tricking a user that got infected into thinking that the phone has been powered off, but in fact, it’s still running. The “NoReboot” approach simulates a real shutdown. The user cannot feel a difference between a real shutdown and a “fake shutdown”. There is no user-interface or any button feedback until the user turns the phone back “on”.
Click to expand...

Log in or Sign up

Threat actors can simulate iPhone reboots and keep iOS malware on a device

guest Guest

Log in or Sign up

Threat actors can simulate iPhone reboots and keep iOS malware on a device

guest Guest

Useful Searches