Computer Help and Support

Ron Obvious

(6,261 posts) Tue Jul 27, 2021, 01:44 PM Jul 2021

Unpatched iPhone Bug Allows Remote Device Takeover

Amazing. It sounds like an old-fashioned sprintf() style bug with unchecked parameters, if that's not too dated a reference these days.

Summary: A Wifi router with the SSID "%p%s%s%s%s%n" can take over your phone if you connect to it (automatically or otherwise)

A format-string bug believed to be a low-risk denial-of-service issue turns out to be much nastier than expected.

A vulnerability in Apple iOS opens the door to remote code execution (RCE), researchers found. The assessment is a revision from a previous understanding of the flaw that viewed it as a low-risk (and somewhat wacky) denial-of-service (DoS) problem affecting iPhone’s Wi-Fi feature.

The original DoS issue is a string-format bug discovered by researcher Carl Schou, who found that connecting to an access point with the SSID “%p%s%s%s%s%n” would disable a device’s Wi-Fi.”

https://threatpost.com/unpatched-iphone-bug-remote-takeover/167922/

1 replies

= new reply since forum marked as read

Highlight:

Unpatched iPhone Bug Allows Remote Device Takeover (Original Post) Ron Obvious Jul 2021 OP

turn off 'auto join'. Always connect and disconnect your wifi manually. Sunlei Jul 2021 #1

Sunlei

(22,651 posts)

1. turn off 'auto join'. Always connect and disconnect your wifi manually.

Reply to Ron Obvious (Original post)

Thu Jul 29, 2021, 11:29 AM

Jul 2021

personally I don't ever use my iPhone for any banking or important account work, but that's just me

Reply to this discussion