Message-ID: <525D3E76.3080005@vulnerability-lab.com>
Date: Tue, 15 Oct 2013 15:09:10 +0200
From: Vulnerability Lab <research@...nerability-lab.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Apple iOS 7.2 - Sim Lock Screen Display Bypass
	Vulnerability

Document Title:
===============
Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1105

Video: http://www.vulnerability-lab.com/get_content.php?id=1104


Release Date:
=============
2013-10-04


Vulnerability Laboratory ID (VL-ID):
====================================
1105


Common Vulnerability Scoring System:
====================================
6.1


Product & Service Introduction:
===============================
iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally unveiled in 2007 
for the iPhone, it has been extended to support other Apple devices such as the iPod Touch (September 2007), iPad (January 2010), 
iPad Mini (November 2012) and second-generation Apple TV (September 2010). Unlike Microsoft`s Windows Phone and Google`s Android, 
Apple does not license iOS for installation on non-Apple hardware. As of August 2013, Apple`s App Store contained more than 900,000 
iOS applications, 375,000 of which were optimised for iPad. These apps have collectively been downloaded more than 50 billion times. 
It had a 21% share of the smartphone mobile operating system units shipped in the fourth quarter of 2012, behind only Google`s Android.
In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod Touch and the iPad).[8] At the half 
of 2012, there were 410 million devices activated. According to the special media event held by Apple on September 12, 2012, 400 million 
devices had been sold by June 2012.

The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements consist 
of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch, all of which 
have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal accelerometers are used 
by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three dimensions (one 
common result is switching from portrait to landscape mode. iOS is derived from OS X, with which it shares the Darwin foundation and 
various application frameworks. iOS is Apple`s mobile version of the OS X operating system used on Apple computers.

Major versions of iOS are released annually. The current release, iOS 7, was released on September 18, 2013. In iOS, there are four 
abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The current version of the 
operating system (iOS 7.0.2), dedicates 1–1.5 GB of the device`s flash memory for the system partition, using roughly 800 MB of that 
partition (varying by model) for iOS itself.

(Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a local bypass vulnerability in the official Apple iOS v7.0.1 Mobile.


Vulnerability Disclosure Timeline:
==================================
2013-04-10:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple
Product: iOS 7.0.1

Apple
Product: iOS 7.0.2


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A restricted screen bypass via design glitch is detected in the official Apple iOS v7.0.1 for Mobile Devices (iPad|iPhone).
The security vulnerability allows local attackers to bypass the display screen of the restricted sim locked mode.

The bypass vulnerability is located in the iOS v7.0.1/7.0.2 when the `sim locked` mode of an iphone mobile is activated.
Local attackers can redirect the sim locked display to the regular default mode by using a restricted calculator function in 
combination with the shutdown and unlock button. As result the local attacker is able to glitch > jump into the regular locked 
phone mode with calender + hyperlinks, camera and control center. The regular sim locked display is at the end usable like in 
the regular mode without sim locked label in the screen.

The local sim lock screen display bypass vulnerability can be exploited by local attackers with physical device access and without 
user interaction. Successful exploitation results in the bypass of the sim lock mode to the regular lock mode. In a earlier test (7.x) 
we combined the earlier discovered issues to first unlock the sim display (locked sim card) and bypass the pass code to fully compromise.


Proof of Concept (PoC):
=======================
The local vulnerability can be exploited by local attackers with physical device access and without user interaction.
For demonstration or reproduce ...

Manual reproduce like in the iphone poc security video ...

1.  Start your iPhone and ensure you have the iOS v7.0.1 installed
2.  Activate the Sim Lock mode
3.  Start the device new and you will see a black notification in the middle of the display (sim locked)
Note: Sometimes the message also comes up in the restricted mode with a grey message box in the middle of the display.
4.  Open the calender, and scroll down to the two hyper links
5.  Press the power button and wait 2 secounds in the last secound your press one of the two hyperlinks
6.  You get redirected via hyperlink because of the restriction to the pass code sim lock
7.  Press again 3 secound the power button and push at the end in the last secound the home button
8.  Click cancel again in the shutdown menu but hold the home button
9.  Open up the control center and go to the calculator. Now a message box appears automatically with the sim lock entry button or the ok cancel
10. Press 3 secounds the shutdown button and in the last secound you press the unlock or ok button and hold home
Note: The pass code module comes up but some milisecounds after it there is an automatic redirect to the earlier opened module (calculator)
11. Now the attacker only press one time 3 secounds the power button again and when its opened he press cancel and one time the home button
12. The locked screen disappears and the restricted screen display mode has been bypassed.


Video PoC: https://www.youtube.com/watch?v=6_e-hvglQdg


Solution - Fix & Patch:
=======================
7.0.3 ?!


Security Risk:
==============
The security risk of the local sim lock display screen bypass vulnerability is estimated as medium(+)|(-)high.


Credits & Authors:
==================
Vulnerability Laboratory [Research Team] - Benjamin Kunz Mejri (bkm@...lution-sec.com) [www.vulnerability-lab.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, 
either expressed or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-
Lab or its suppliers are not liable in any case of damage, including direct, indirect, incidental, consequential loss of business 
profits or special damages, even if Vulnerability-Lab or its suppliers have been advised of the possibility of such damages. Some 
states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation 
may not apply. We do not approve or encourage anybody to break any vendor licenses, policies, deface websites, hack into databases 
or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com   	- www.vuln-lab.com			       - www.evolution-sec.com
Contact:    admin@...nerability-lab.com 	- research@...nerability-lab.com 	       - admin@...lution-sec.com
Section:    www.vulnerability-lab.com/dev 	- forum.vulnerability-db.com 		       - magazine.vulnerability-db.com
Social:	    twitter.com/#!/vuln_lab 		- facebook.com/VulnerabilityLab 	       - youtube.com/user/vulnerability0lab
Feeds:	    vulnerability-lab.com/rss/rss.php	- vulnerability-lab.com/rss/rss_upcoming.php   - vulnerability-lab.com/rss/rss_news.php

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. 
Permission to electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other 
media, are reserved by Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and 
other information on this website is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), 
modify, use or edit our material contact (admin@...nerability-lab.com or research@...nerability-lab.com) to get a permission.

				Copyright © 2013 | Vulnerability Laboratory [Evolution Security]




-- 
VULNERABILITY LABORATORY RESEARCH TEAM
DOMAIN: www.vulnerability-lab.com
CONTACT: research@...nerability-lab.com


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists