Category: Cyber Security

How To Protect Your iPhone From The “No iOS Zone” Vulnerability

There’s been a serious iOS vulnerability uncovered recently by security research company, Skycure that you should know about.

This bug is exploited by means of just a WiFi connection and will put your iOS device into a never-ending bootloop for as long as you are in range of the malicious WiFi connection. -nice going, Apple-

“It puts the victim’s device in an unusable state for as long as the attack impacts a device. Even if victims understand that the attack comes from a Wi-Fi network, they can’t disable the Wi-Fi interface in the repeated restart state.” -Skycure

Attackers can fairly easily weaponize a WiFi network through use of a modified SSH certificate which, when your iOS device attempts to parse it, starts the bootloop.

So, the only way that iOS device owners would be able to stop the bootloop would be to get out of range of the malicios WiFi network.

How To Protect Against The No iOS Zone

Below, you’ll find the advise that the original discoveres of the vulnerability have given for avoiding the problem alltogether.

1. In general, everyone should be avoiding connecting to any suspicious “FREE” Wi-Fi network.

2. Update your iOS device to 8.1.3, as the attack is sometimes not as effective on this version.

3. If you are able to get to the WiFi settings toggle before the next crash, try to disconnect from the WiFi network or just turn your phone to airplane mode altogether.

Ultimately Apple are the ones that need to come up with a fix quickly, and as of the time of this posting, they have yet to disclose when this will be patched.

April 23, 2015
Popular WiFi Routers Are Susceptible To Mass Hacking Says Researcher

Over 650,000 ADSL routers that are extremely vulnerable to hacking have been ousted to the public by ISP’s worldwide.

Of the numerous exposed flaws, one of the largest appears to be a directory traversal vulnerability which exists under a component under the name of webproc.cgi. This vulnerability allows hackers to gain access to admin credentials, potentially letting them steal data that’s important to the victim.

Perhaps the most astounding part of this story though, is that that researchers first discovered, and exposed this flaw back in 2011 but in only a select few models.

More recently though, a lone security researcher, Kyle Lovett, while analyzing some ADSL routers, uncovered this vulnerability in a huge amount of routers. After further investigation he ended up uncovering hundreds of thousands of susceptible devices located around the world.

Just taking a wild guess, this happened on such a large scale, and the problem was swept aside so long because of the ISP’s.

Most ISP’s provide customers (force them into using) their own ADSL modems, even if you want to use your perfectly good one. Maybe they have a deal with the NSA, some custom spy software installed maybe?

So it’s no wonder that by pushing these modems, there would be a mass risk for vulnerabilities to be exploited.

There’s actually more than just the webproc.cgi flaw though, there’s several other massive flaws.

Around 60 percent of the modems have a hidden account, supposedly for “support purposes” with a laughably easy to guess, hard coded password. These 60% of devices all share the same password.

For a quarter of the routers, hackers are able to take a snapshot of the modems active memory. Of course this is a big issue, because this memory can contain credentials for past visited website, in plain text.

Worst yet, Lovett was able to track down the IP addresses of hackers exploiting these vulnerabilities, and most of the addresses were coming from China.

An expected fix for these vulnerabilities has yet to be rolled out, but for the time being you can check to see if your modem is effected by looking at the list – here

March 25, 2015

Category: Cyber Security

How To Protect Your iPhone From The “No iOS Zone” Vulnerability

How To Protect Against The No iOS Zone

Popular WiFi Routers Are Susceptible To Mass Hacking Says Researcher