The attack comes from a flaw in Apple Safari browser
A newly developed cyberattack proof of concept can cause iOS devices to restart or collapse using only 15 lines of code, unveiled an expert on ethical hacking over the last weekend.
On Saturday, researcher Sabri Haddouche, a specialist in ethical hacking, posted on Twitter the source code of the attack’s proof of concept which, as he said, is able to restart iOS devices (such as iPhone or iPad) with only a few lines of Cascade Style Sheets (CSS) specially designed code.
The researcher commented that he made this discovery after observing some denial of service (DoS) attacks on browsers last week, mentioning that users who open a specially formatted link from any iOS-based browser, or use Safari on macOS are aware of the attack. Haddouche mentioned several specialized media that has already notified Apple and the company is addressing the problem.
The attack comes from an error in WebKit, an HTML browser engine in the Apple Safari browser. The web browser engine is used by several applications, including Apple’s own email application, the official App Store, and other applications that use the underlying browser code on macOS, iOS, and some Linux versions.
Although WebKit serves to process HTML and CSS lines, there are certain elements that it cannot processes, including one called <div> specifically used in the attack shown by Sabri Haddouche.
Haddouche nested these incompatible elements in the CSS property background filter, which is a line of code that allows users to apply graphical effects such as blur or color change to the area behind an element. Once this was done in the proof of concept, the WebKit engine was unable to perform its processing tasks, causing it to deplete all of the device’s resources and activate the panic kernel.
The researcher mentioned that the source code of the attack can be integrated into any website, email, QR code and, immediately, make any device collapse.
According to ethical hacking specialists from the International Institute of Cyber Security, the code has to be sent and opened by the victim to properly work, which means that an attacker could incorporate it in an HTML email and send it to a selected target, whose iOS device will be locked when the victim open the link.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
