Document Title: =============== Apple iOS v6.1 (10B143) - Pass Code Bypass Vulnerability 2 Date: ===== 2013-02-21 References: =========== http://www.vulnerability-lab.com/get_content.php?id=875 (Advisory) http://www.vulnerability-lab.com/get_content.php?id=874 (Video) VL-ID: ===== 875 Common Vulnerability Scoring System: ==================================== 6.5 Introduction: ============= iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally released in 2007 for the iPhone and iPod Touch, it has been extended to support other Apple devices such as the iPad and Apple TV. Unlike Microsoft`s Windows Phone (Windows CE) and Google`s Android, Apple does not license iOS for installation on non-Apple hardware. As of September 12, 2012, Apple`s App Store contained more than 700,000 iOS applications, which have collectively been downloaded more than 30 billion times. It had a 14.9% share of the smartphone mobile operating system units shipped in the third quarter of 2012, behind only Google`s Android. In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod Touch and the iPad). At the half of 2012, there were 410 million devices activated. According to the special media event held by Apple on September 12, 2012, 400 million devices have been sold through June 2012. The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements consist of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch, all of which have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal accelerometers are used by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three dimensions (one common result is switching from portrait to landscape mode). iOS is derived from OS X, with which it shares the Darwin foundation. iOS is Apple`s mobile version of the OS X operating system used on Apple computers. In iOS, there are four abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The current version of the operating system (iOS 6.1) dedicates 1-1.5 GB of the device`s flash memory for the system partition, using roughly 800 MB of that partition (varying by model) for iOS itself. Usage: iOS currently runs on iPhone, Apple TV, iPod Touch, and iPad. (Copy of the Homepage: http://en.wikipedia.org/wiki/IOS ) Abstract: ========= The Vulnerability Laboratory Research Team discovered a pass code (lock) bypass vulnerability in the official Apple iOS v6.1 (10B143) for the iPhone. Report-Timeline: ================ 2013-02-15: Public Disclosure Status: ======== Published Affected Products: ================== Apple Product: iOS v6.1 (10B143) Exploitation-Technique: ======================= Local Severity: ========= High Details: ======== A pass code bypass vulnerability via iOS as glitch is detected in the official Apple iOS v6.1 (10B143) for the iPhone. The vulnerability allows an attacker with physical access to bypass via a glitch in the iOS kernel the main device pass code lock (auth). The vulnerability is located in the main login module of the mobile iOS device (iphone or ipad) when processing to use the screenshot function in combination with the emegerncy call and power (standby) button. The vulnerability allows the local attacker to bypass the pass code lock when processing to sync via iTunes or via USB when a black screen bug occurs. The vulnerability can be exploited by local attackers with physical device access without privileged iOS account or required user interaction. Successful exploitation of the vulnerability results in unauthorized device access and information disclosure. Vulnerable OS: [+] Apple iOS v6.1 & v6.0.1 Vulnerable Module(s): [+] Passcode Auth - Device Login Used Function(s): [+] Power off [Weak up] (Standby) Button [+] Square Button (Screenshot) [+] Emergency Button Affected Device(s): [+] iPhone 5 - iOS v6.1 Proof of Concept: ================= The local code lock bypass vulnerability to access the iphone or ipad can be exploited by local attackers without required user interaction or privileged iOS user account. For demonstration or reproduce ... Manually steps to reproduce ... Passcode Bypass #2 0. Connect your device with itunes and the appstore to make sure the passcode screen lock is activated 1. Push the power button (top|right) 2. The mobile will be activated and the iOS code lock will be visible 3. Now, you click on the emergency call 4. Try to dail any random emergency call number from a public listing (we used 911, 110 and 112) 5. Call the number and cancel the call directly after the dail without a direct connection to the number 6. Push again the power button and push after it the iphone button (square) in the middle 7. In the next step you push the power button 3 seconds and in the third second you push also with one finger the square and with another the emergency call button 8. After pushing all 3 buttons you turn your finger of the square (middle) button and after it of the power button 9. The display of the iOS will be black (blackscreen) and the status bar on top will be blue (standard template background) 10. Take your usb plug and connect it with the iOS device in black screen mode with blue status bar 11. All files like photos, contacts and co. will be available directly from the device harddrive and iTunes sync is possible without pass code pin. 12. Successful reproduced! Video: http://www.vulnerability-lab.com/get_content.php?id=874 Public Video: http://www.youtube.com/watch?v=DiHz_jkWjsE 0. http://i45.tinypic.com/2lrfgi.png 1. http://i48.tinypic.com/10odysn.png 2. http://i50.tinypic.com/6p181s.png 3. http://i50.tinypic.com/i4l6r9.png 4. http://i48.tinypic.com/102nqlu.png 5. http://i50.tinypic.com/2a9pqqf.png 6. http://i48.tinypic.com/acsv1c.png 7. http://i50.tinypic.com/2rcs6dz.png 8. http://i48.tinypic.com/etbs09.png 9. http://i50.tinypic.com/23vx5xf.png 10. http://i46.tinypic.com/261i1hd.png 11. http://i48.tinypic.com/acsv1c.jpg 12. http://i46.tinypic.com/2u7x4k7.png 13. http://i47.tinypic.com/k0fzmw.png 14. http://i50.tinypic.com/28mnuw1.png 15. http://i48.tinypic.com/241qd5z.png 16. http://i47.tinypic.com/spximw.png 17. http://i45.tinypic.com/27xil8w.png 18. http://i47.tinypic.com/3090fad.png 19. http://i46.tinypic.com/2vtv5h0.jpg Note: Normally the template of the status bar on top shows does not show the blue standard background. The bug has been successful exploited when you the attacker is pressing no button and the status bar is stable loaded in blue with a blackscreen. Risk: ===== The security risk of the local passcode (pin lock) bypass vulnerability in iOS v6.1 (10B143) and iOS v6.0.1 is estimated as high. Credits: ======== Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@vulnerability-lab.com) Disclaimer: =========== The information provided in this advisory is provided as it is without any warranty. Vulnerability-Lab disclaims all warranties, either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability- Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases or trade with fraud/stolen material. Domains: www.vulnerability-lab.com - www.vuln-lab.com - www.vulnerability-lab.com/register Contact: admin@vulnerability-lab.com - support@vulnerability-lab.com - research@vulnerability-lab.com Section: video.vulnerability-lab.com - forum.vulnerability-lab.com - news.vulnerability-lab.com Social: twitter.com/#!/vuln_lab - facebook.com/VulnerabilityLab - youtube.com/user/vulnerability0lab Feeds: vulnerability-lab.com/rss/rss.php - vulnerability-lab.com/rss/rss_upcoming.php - vulnerability-lab.com/rss/rss_news.php Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, sourcecode, videos and other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact (admin@vulnerability-lab.com or support@vulnerability-lab.com) to get a permission. Copyright © 2013 | Vulnerability Laboratory