CVE-2016-1788 is difficult to exploit, but within the capabilities of nation state attackers. Users are advised to update to iOS 9.3 to reduce the risk of attack.
Users of Apple devices such as the iPhone and iPad are advised to update to the latest version of the iOS operating system (iOS 9.3), following the discovery of a vulnerability that could potentially allow attackers to access and decrypt iMessage attachments.
iMessage is a built-in messaging system on devices running iOS. While its messages are encrypted, a team of researchers at Johns Hopkins University discovered a vulnerability (CVE-2016-1788) that allowed them to decrypt iMessage attachments.
Flawed encryption mechanism
The Johns Hopkins team found that there were “serious flaws” in the encryption mechanism used by iMessage which could allow a remote attacker to recover and decrypt an iMessage attachment. Exploit of the vulnerability was “difficult in practice,” they said, but certainly within the capabilities of nation state attackers.
The researchers discovered that if an attacker obtained a copy of an encrypted iMessage, they could mount a brute-force type attack by sending hundreds of thousands of malformed encrypted messages to a targeted iOS device. By noting the response of the device, the attackers can gradually generate a decryption key.
In the case of a standard message sent using iMessage, the attack won’t work because the targeted device doesn’t send a response. However, it will work on iMessage attachments. This is because the attachment is uploaded to iCloud and not sent to the recipient directly. What the recipient receives is an iCloud URL, a SHA1 hash, and a decryption key.
An attacker can alter the URL in the message to point it to an attacker-controlled domain rather than iCloud. By monitoring the download attempts made by the targeted device, an attacker can piece together the encryption key for the attachment and download it themselves.
Avoid complacency
There is no evidence to suggest that this vulnerability has been exploited to date the wild. The Johns Hopkins team said that the attack is quite slow to perform, taking more than 70 hours, but believed that it could be refined to run in a fraction of a day. Given the complexity of the attack, the resources required to mount it, and the fact that the vulnerability has already been patched, attempts to exploit it may be confined to targeted attacks by high level attack groups. Nevertheless, iOS users are advised to update their software in order to minimize risk.
Source:https://www.symantec.com/
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
