Files Shared: Not In The Wild iOS 8 SSL Certificate Parsing Bug Crash Crash Crash

Monday, February 6, 2017

Not In The Wild iOS 8 SSL Certificate Parsing Bug Crash Crash Crash

Interest Level: Background

The system used to encrypt data sent across the Internet has had a bad time this past year. A parade of bugs and exploits have been found. Related problems in hash functions have been found. Fraudulent security certificates have been forged by questionable certificate authorities. Google has injected a level of paranoia as well as demands for technology improvements, while itself ignoring its own aspirations. The result is a complicated and confusing mess that leaves users wondering what is safe and what is not.

On Wednesday, Dan Goodin of Ars Technica reported a new twist in the Internet encryption contortions by way of a report and public presentation from the company Skycure. They have found a bug in iOS 8 that allows an attack on iOS devices over Wi-Fi through the use of a malicious SSL security certificate. This attack can trigger Apple devices running iOS 8 to go into an endless crash loop while in the connection vicinity of the offending Wi-Fi network.

Note that this bug is NOT yet being exploited in the wild. It is at this point simply of interest while we wait for Apple to patch the bug and prevent it from becoming a real problem for users.

Below, I have linked both Dan Goodins article and the source blog post from Skycure.

If youre interested in higher level Mac and iOS security, this is well worth a read. Otherwise, its in the background as only a potential problem to iOS users.

iOS bug sends iPhones into endless crash cycle when exposed to rogue Wi-Fi
SSL cert parsing error allows attackers to create "No iOS Zone," researchers say.
- Dan Goodin, Ars Technica

“No iOS Zone” – A New Vulnerability Allows DoS Attacks on iOS Devices
- Yair Amit, Skycure

Both articles provide videos illustrating the SSL certificate bug.

Share and Enjoy,
:-Derek

Go to link Download