WiFiDemon – Recently discovered iPhone Wi-Fi bug could also allow RCE

A recently discovered iPhone Wi-Fi bug that could crash the WiFi connectivity could be exploited by attackers to achieve remote code execution.

In June, the researcher Carl Schou discovered a new bug in iPhone that can permanently break users’ WiFi by disabling it, the issue could be triggered by simply connecting to a rogue hotspot. 

Once an iPhone established a WiFi connection to a rogue hotspot, it will no more be able to establish a connection to a Wi-Fi device, even if it is rebooted or the WiFi hotspot is renamed.

Schou noticed the issue because he had problems after logging into his personal WiFi hotspot named %p%s%s%s%s%n using his iPhone running iOS 14.4.2, but the expert noticed that the issue also impacts iPhone XS, running iOS version 14.4.2.

This kind of bug could have a severe impact in a real attack scenario that sees a threat actor setting up an open rogue WiFi hotspot in a crowded area such as a hotel hall or a station.

The only way to restore the Wi-Fi functionality was to reset the network settings of the impacted iPhone.

Independent security researchers speculate that the flaw could be caused by a parsing issue in the Wi-Fi settings.

Apple iOS may be misinterpreting the letters following the character “%” as string-format specifiers instead of considering it as part of the name of the specific hotspot.

The only way to restore a device is to reset your iOS network settings with these simple steps:

Go to Settings on your iPhone, select General.Select Reset.Select the ‘Reset Network Settings’ option, the device will reboot and network settings will be reverted to the factory default.

Apple will likely address the flaw with the release of the iOS 14.7 update.

Now researchers from mobile security firm ZecOps discovered that this bug could be exploited to achieve remote code execution (RCE) on target devices by appending the string pattern “%@” to the Wi-Fi hotspot’s name. They tracked the issue as WiFiDemon and explained that it is a zero-click flaw that could allow attackers to infect a device without any user interaction.

The only pre-requisite for the exploitation of the bug is the WiFi to be open with Auto-Join (which is enabled by default).

“As long as the WiFi is turned on this vulnerability can be triggered. If the user is connected to an existing WiFi network, an attacker can launch another attack to disconnect/de-associate the device and then launch this 0-click attack.” states the report published by the experts. “This 0-click vulnerability is powerful: if the malicious access point has password protection and the user never joins the wifi, nothing will be saved to the disk. After turning off the malicious access point, the user’s WIFI function will be normal. A user could hardly notice if they have been attacked.”

The RCE bug affected iOS versions from iOS 14.0 and prior to iOS 14.3. Experts pointed out that Apple “silently” addressed the flaw in January 2021 with the release of iOS 14.4 update.

“However, since this vulnerability was widely published, and relatively easy to notice, we are highly confident that various threat actors have discovered the same information we did, and we would like to encourage an issuance of a patch as soon as possible.” concludes the report.

iPhone and iPad users have to update their devices to the latest iOS version to secure their devices.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, iphone)