Apple has had screw up after screw up for the past couple of weeks. The first in a long
list of snafus is a rather interesting arbitrary code execution bug hidden within MacOS, Apple
tried patching this exploit, but failed miserably - more on that in a bit. The vulnerability
makes use of the little known file type “inetloc” - which stands for “internet network location”
- or at least that’s my best guess as this macos file extension is so unknown that Apple's
own dev site doesn’t even have an article on it, the earliest reference to this little
known filetype that I can find is a forum post about it from 2004. “Inetloc” files
are essentially meant to facilitate internet shortcuts, drag a link from a text editor
to a Mac’s desktop and you get one of these internet shortcut files. But someone figured
out you could also use it as a shortcut to open local files using the “file” prefix
instead of http.
This proof of concept opens the calculator app, which doesn’t sound so harmful. But
if you configure one of these files to open a terminal window and pass certain arguments
through, then it could become a whole lot more nefarious. A bad actor can add these
shortcut files as email attachments, which can quite easily be opened within Mac OS’
native Mail app as it doesn’t warn you the file you’re opening could be harmful.
To make matters worse, Apple released a patch for this bug last year in Big Sur, however
it’s been uncovered that Apple didn’t put their fix through even the most rudimentary
of checks. As, whilst the “file” prefix is now disallowed and trying to open an “inetloc”
file will simply return an error, Apple didn’t take into account uppercase characters in
that file prefix, meaning, switching any of the characters to uppercase will bypass Apple’s
fix - and allow you to run your evil wares on any given Mac.
There’s no evidence of anyone actively exploiting this bug in the wild, at least not that I’ve
seen, but as of making this video, the vulnerability is still active in the latest version of Mac
OS. The bug itself was responsibly disclosed via the SSD disclosure program, where you
can find that proof of concept code.
A rather serious flaw in Apple’s contactless payment system ‘Apple Pay’ has been discovered
by researchers here in the UK. The exploit allows an attacker to activate Apple pay without
unlocking your phone and secretly trigger transactions costing you thousands of pounds.
This could all be done whilst your phone is tucked away in your pocket, using relatively
cheap rfid hacker hardware.
The researchers published a paper which explains the hack, but they leave out some details
to make it more difficult for criminals who want to take advantage of this. The researchers
had no choice but to be careful with what they published because whilst they initially
reported the problem to Apple this time last year, it still hasn’t been patched, but
more on that in a bit.
This vulnerability works by exploiting iPhone’s “Express travel” feature. Usually you
have to unlock your iphone to use apple pay, but this feature allows you to use Apple pay
whilst locked, but only with certain pre approved travel networks. This makes it easy to pay
for public transport on the go without unlocking your phone every time you get on a bus.
The white hats found that these pre approved public transport readers transmit what the
researchers have dubbed “magic bytes”, which are able to unlock apple pay without
user authentication. The researchers figured out that by replaying these magic bytes to
a target phone they could trick it into thinking it was a legitimate payment terminal. A video
they made demonstrates the hack in action.
The researchers used a proxmark that interacts with the target, performing the “magic bytes”
hack. A proxmark is essentially an RFID and NFC hacking tool - they cost a few hundred
pounds at most and definitely aren’t hard to get a hold of. The proxmark communicates
with a connected computer which in turn communicates with an android device. The android device
acts as a card simulator, which can be used to transact with any payment terminal just
as if it were the victim iPhone.
So here they run the script from the laptop, the target iPhone has its apple pay activated
whilst locked. The android device is then used as a conduit to make the actual payment
with an attacker controlled payment terminal. So in a real life scenario someone could touch
a proxmark device in public to someone’s pocket containing a target phone. The proxmark
could then talk to a laptop in their bag which could in turn communicate with the malicious
android device over the internet to someone miles away, even in another country, which
could then make the fraudulent transaction.
It’s a very involved hack, and would obviously take some real technical knowledge on the
part of an attacker, but it is eminently doable - and the reward for going to the effort of
all this is quite high - the researchers were able to make a fraudulent transaction of 1
thousands pounds. Something to note is that this only affects visa cards, other payment
systems don’t have this issue. But given Visa makes up half of all credit card purchases
worldwide, it is a big problem.
So surely Apple and Visa have come together to provide some panacea for this problem?
Not so fast. “The details of this vulnerability have been disclosed to Apple and to Visa Both
parties acknowledge the seriousness of the vulnerability, but have not come to an agreement
on which party should implement a fix.” I couldn’t find a statement from Visa or
Apple, it just seems like they’ve been dragging their heels on this one, and I haven’t seen
any reasonable excuses describing any technical challenges a fix would pose.
The best thing you can do is simply not use the express payment option on an iphone with
a visa card - or vote with your wallet and switch from Visa to literally anything else.
Apple’s brand new iCloud private relay service has been found to have a vulnerability which
makes the whole system kinda useless, the exploit can be used to grab a user’s IP
address. iCloud private relay is kind of like a VPN built into iPhones. But it only works
on safari and doesn’t hide the region you’re located in, so it’s not really on the same
level as a VPN.
The vulnerability is made possible by a browser API called webRTC. It’s “a browser API
for websites to establish direct communication between website visitors” “All modern
browsers support WebRTC natively; for example, Google Hangouts is one of the more popular
applications that uses WebRTC”.
I’m abstracting away a lot of the detail here, but essentially when a browser wants
to connect to another browser using webrtc it’ll send its connection details such as
ip and port to the website’s server from where it is communicated with the other browser.
Long story short, this is how the real ip of a user can be leaked - as Apple forgot
to include this kind of communication within the scope of private relay. The exploit is
a testament to the fact that private relay shouldn’t really be relied upon to keep
you hidden, it is at best a quasi VPN. However in fairness, private relay is currently still
in beta and a fix for this bug has already been rolled out to the MacOS version, presumably
with the iPhone update soon to come.
If you want to be certain your ip is hidden you’ll need to use a device wide proxy or
VPN, which funnily enough today’s sponsor can help you with.
VPNs are useful, and aim to keep you private and secure, but they come with a trove of
issues. Mainly, would you entrust a VPN company with your traffic over your ISP? The bottom
line is that if you didn't set up the VPN server yourself, you really can't be sure
that these VPN companies won't keep logs, sell your data, or monitor your traffic. That's
why I’ve teamed up with Linode to give you the opportunity to host your own private VPN
for free. Linode is a totally customisable cloud hosting platform with a whole host of
server apps you can install with one click. Using their wireguard or openVPN apps you
can spin up a private VPN controlled wholly by yourself in a matter of minutes.
Linode launched way back in 2003, that’s 3 years before AWS was even a thing, Linode
doesn’t spend a second on side hustles like grocery chains or reading you bedtime stories,
cloud computing is what they do best, and is their only focus. Linode is offering all
of you guys $100 in free credit just for signing up, use your $100 to instantiate your private
VPN or literally anything else cloud computing related. They have 24/7 phone support (which
is a godsend in the world of servers) so you’ll never be left out in the cold.
Go to linode.com/seytonic or click the link in the description to claim your free $100.
A bug hunter has shared his frustrating experience dealing with Apple. Within a new blog post
he publicly discloses multiple active vulnerabilities in the latest version of iOS - not usually
the done thing for white hats, but more on that in a sec.
One Denis responsibly reported all of these bugs to Apple in some cases over 6 months
ago. But Apple didn’t seem to care… Apple acknowledged Denis’s submissions but never
fixed the bugs, even despite him pestering Apple about them every few months. Publicly
disclosing active vulnerabilities with proof of concept code is only really seen as acceptable
if a white hat has exhausted all means of responsibly informing developers of the problem.
This is a textbook example of when it’s reasonable to just publicly tell everyone
there’s active zero days out there.
To make matters worse these bugs aren’t completely trivial. They allow malicious apps
to access apple ID account information, Apple ID authentication tokens, contacts from mail,
pull details of the WiFi network you’re connected to, and so on. Apple did patch one
of these vulnerabilities, but strangely details of the fix were missing from Apple’s public
list of security updates. Apple said this was “due to a processing issue” and the
researcher’s “credit will be included on the security advisories in an upcoming
update.” but the next update came and there was still no mention of the bug.
It’s all very strange, this guy goes out of his way to responsibly inform Apple of
problems in their OS, but they don’t bother to fix the vulnerabilities he finds, and when
they do get around to patching one of them, they refuse to credit him. Apple responded
to his blog post just 24 hours after it went live. Very weird timing there, Apple seems
to be very snappy in getting to issues which harm their reputation. In the response they
apologised for the delay and said they’re still investigating the vulnerabilities he
uncovered.
Quite astonishingly, the same day the blog post went up, a jailbreaker on reddit released
fixes for the bugs. To clarify, a guy on reddit managed to patch multiple vulnerabilities
the same day they were made known to him, but the most valuable company on earth couldn’t
patch them in 6 months, and still hasn’t! If you enjoy this kind of video make sure
to help me out by fondling the like button for the youtube AI as well as turning on those
sub notifications.
If you want to see what goes on behind the scenes make sure to follow me on the instagrams,
I’m @jhonti I will of course link it in the description.
If you’re looking for something to watch next go check out my previous video on how
Anonymous hacked the controversial hosting provider Epik.
As always sources will be linked in the video description, stay tuned for more hacking videos,
and have a good one.