IPhone zero-click Wi-Fi exploit: One of the most breathtaking hacks

[jedishrfu]

TL;DR Summary

Before Apple patch, Wi-Fi packets could steal photos. No interaction needed. Over the air.

https://arstechnica.com/gadgets/202...t-is-one-of-the-most-breathtaking-hacks-ever/

Earlier this year, Apple patched one of the most breathtaking iPhone vulnerabilities ever: a memory corruption bug in the iOS kernel that gave attackers remote access to the entire device—over Wi-Fi, with no user interaction required at all. Oh, and exploits were wormable—meaning radio-proximity exploits could spread from one nearby device to another, once again, with no user interaction needed.

This Wi-Fi packet of death exploit was devised by Ian Beer, a researcher at Project Zero, Google’s vulnerability research arm. In a 30,000-word post published on Tuesday afternoon, Beer described the vulnerability and the proof-of-concept exploit he spent six months developing single-handedly. Almost immediately, fellow security researchers took notice.

 

[pbuk]

Why repeat the sensationalist headline?

 

[jedishrfu]

Ask not why but why not.

 

[sysprog]

Why repeat the sensationalist headline?

As @jedishrfu said, "ask . . . why not" $-$ it seems sensational enough $-$ from the cited 30,000-word post:

This demo shows the attacker successfully exploiting a victim iPhone 11 Pro device located in a different room through a closed door. The victim is using the Youtube app. The attacker forces the AWDL interface to activate then successfully exploits the AWDL buffer overflow to gain access to the device and run an implant as root. The implant has full access to the user's personal data, including emails, photos, messages, keychain and so on. The attacker demonstrates this by stealing the most recently taken photo. Delivery of the implant takes around two minutes, but with more engineering investment there's no reason this prototype couldn't be optimized to deliver the implant in a handful of seconds.