Apple iOS flaw exploitable to steal user password with a phishing email

A security expert demonstrated how to exploit a vulnerability in Apple IOS system to steal user password with a phishing email.

A new vulnerability that affects Apple’s iOS could be exploited by hackers to collect user passwords by using a single email.

Jan Soucek (@jansoucek) , a forensic expert at Ernst and Young has developed a tool, the iOS 8.3 Mail.app inject kit, that could be used to create malicious iCloud password phishing emails. The expert explained that he exploits an unpatched bug affecting Apple iOS.

“Ernst and Young forensic bod Jan Soucek has created a tool capable of generating slick iCloud password phishing emails he says exploits an unpatched bug affecting millions of Apple users.” states the Register.

The iOS 8.3 Mail.app inject kit exploits a vulnerability in the Apple operating system’s native email client that allows and attacker to display a realistic pop-up.

Soucek tried to contact the Apple, but he hasn’t received any reply from Cupertino since January.

“Back in January 2015 I stumbled upon a bug in iOS’s mail client, resulting in HTML tags in email messages not being ignored,” Soucek says.

Soucek discovered that Apple ignores a key line of code in incoming emails: <meta http-equiv=refresh>, this means that an attacker can remotely load arbitrary HTML content inside an email when victims open it on an iPhone, iPad or iPod.

iphone

“This bug allows remote HTML content to be loaded, replacing the content of the original email message. JavaScript is disabled in this UIWebView, but it is still possible to build a functional password ‘collector’ using simple HTML and CSS.” said the researcher.

“It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2.”

Attack scenario

The attacker sends a malicious email that looks like it’s from a legitimate source, but instead it propose a realistic input form used to steal victim’s password.

Here’s a video PoC:


 

Pierluigi Paganini

FAIR USE NOTICE: Under the "fair use" act, another author may make limited use of the original author's work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material "for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright." As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner's exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.

Global InfoSec Awards 2022

We are in our 10th year, and these awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.

APPLY NOW