This New Security Flaw Makes iOS Susceptible To Key-Logging
Who doesn't enjoy reading about a new iOS security threat over breakfast? This latest bug in the OS, detailed in a recent blog post from research firm FireEye, provides hackers with the chance of remotely logging keystrokes made on an iPhone, iPad, or iPod touch.
The news reached us from Ars Technica, which explained in a recent article that virtual keystrokes, interaction with Touch ID, and even volume key presses can be covertly recorded using the newly discovered technique. Devices running iOS 7.0.4, iOS 7.0.5, iOS 7.0.6, and iOS 6.1.x are susceptible to the method, from what we understand.
Though the method does require a host application to have been installed on one's iOS device, the slew of “questionable” apps previously (and presently) available in the App Store – which has ranged from unauthorized emulators to “copycat” and even iOS tethering apps – indicates that getting past Apple's App Store approval team wouldn't be too difficult a task.
FireEye explains:
We have created a proof-of-concept “monitoring” app on non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all the user touch/press events in the background, including, touches on the screen, home button press, volume button press and TouchID press, and then this app can send all user events to any remote server, as shown in Fig.1. Potential attackers can use such information to reconstruct every character the victim inputs.
Note that the demo exploits the latest 7.0.4 version of iOS system on a non-jailbroken iPhone 5s device successfully. We have verified that the same vulnerability also exists in iOS versions 7.0.5, 7.0.6 and 6.1.x. Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.
Here's a screenshot demonstrating how keystrokes can be logged using the method:
The malicious host app appears to run in the background in order to undertake keylogging, and as such, a way of ensuring you're not at risk would be to close any suspicious looking iOS apps using the multitasking interface (or, of course, to simply not download them in the first place). Apple hasn't commented on the matter, but we're hoping to see a patch released in the coming days.
It's certainly been a tough time for Apple's iOS security team: not long ago, we explained how iOS 7.0.6 was released to patch another serious security flaw in the mobile OS. This particular problem can compromise OS X, too, yet curiously Apple has failed to release a patch for its desktop OS (as of this writing). For now, the best practice would be for Mac owners to use a third-party browser for handling sensitive information.
We'll keep you updated with further information as we receive it.
In the meantime, see: Pocket Informant Gains New Features In First Update Following Freemium Switch, Broadcom's New 5G 802.11ac Wi-Fi Chip Could Make An Appearance In The iPhone 6, and 'Netflix For Books' App Oyster Updated With New Explore Tab And Other Improvements.
