Symantec professionals have found a vulnerability that could allow hackers to compromise iOS devices without the owner’s knowledge.
This iOS attack named as “Trustjacking” by information security researchers exploits a vulnerability in iTunes Wi-Fi Sync, a special feature that allows iOS devices to synchronize with iTunes without having to physically connect the device. This feature can be enabled by physically connecting an iOS device to a computer, specifying that the iOS device can trust the computer, and then enable iTunes Wi-Fi Sync from the PC. Once a reliable Wi-Fi Sync connection is established, the hacker could have access to the user’s computer; the hacker could secretly spy on the iOS device or record and control any type of activities remotely.
“With this the computer could access the photos on the device, make a backup, and install applications and much more, without requiring another confirmation by the user and without any noticeable indication. It also allows activating the function “iTunes Wi-Fi synchronization”, which allows continuing this type of communication with the device even after it has been disconnected from the computer, provided that the computer and the iOS device are connected to the same network. It is important to mention that enabling “iTunes Wi-Fi synchronization” does not require the approval of the victim and can be carried out purely from the side of the computer, “wrote Roy Iarchy, head of research at Modern OS Security.
Adi Sahabani, senior vice president of modern security for the operating system at Symantec, said it is “extremely shocking.” Adi was the one who revealed the findings at RSAC 2018 last Wednesday along with his colleague Iarchy.
The report states that once the malicious computer is authorized, there is no means to prevent continued access to the device. The information security expert said that users do not receive any message or notification when authorizing the computer; they allow access to their device even after disconnecting the USB cable.
“Even if the device is only connected for a very short time, it may be enough for an attacker to maintain visibility of all actions performed on the device after disconnecting it,” Iarchy wrote. The professionals revealed the vulnerability to Apple, which addressed the problem by adding an additional layer of protection in iOS 11. The new layer requires the iOS user to enter their password when they trust a computer. However, information security researchers believe that such measures are inadequate.
“The user is told that this authorization is only relevant while the device is connected to the computer, this makes the user believe that unplugging his device guarantees that nobody can access his private data,” Iarchy writes in a publication. “While we appreciate the mitigation that Apple has taken, we would like to emphasize that it does not address Trustjacking in a holistic way. Once the user has chosen to trust the compromised computer, the rest of the exploit continues to work. ”
Information security analysts suggest that users enable encrypted backups in iTunes and select a secure password to protect their devices. The users should also go to Settings> General> Reset> Reset location and privacy, and reauthorize previously connected computers.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
