Skip to content

FireEye discovered an Apple vulnerability which allows iOS keylogging

by Pierluigi Paganini on February 27th, 2014
Apple vulnerability keylogger 3

Researchers at FireEye have developed a POC that exploits an Apple vulnerability to implement a Background Monitoring on Non-Jailbroken iOS 7 Devices.

A vulnerability in Apple products is once again the center of controversy because and also in this case the user’s privacy is at risk. The excellent team of security researchers at FireEye discovered another Apple vulnerability that can be exploited by attackers to track users’ finger swipes on iOS Devices including iPhone and iPad.

Just last week Apple released a security update to iOS (iOS 7.06) to fix a flaw for certificate-validation checks that could be abused by attackers to conduct a man-in-the-middle attack within the victim’s network  to capture or modify data even if protected by SSL/TLS. In reality the checks were present in past versions, but they were not included in the recent version of the operating system for an unspecified amount of time.

This time the exploit targets an Apple vulnerability related to iOS multitasking management, in particular the capabilities to capture user inputs in concomitant with other operations. 

I appreciated the way they were able to bypass the Apple’s app review process to create a “Background Monitoring on Non-Jailbroken iOS 7 Devices” (working on versions 7.0.4, 7.0.5, 7.0.6, and 6.1.x.) and in ethical way they also proposed mitigation strategy. FireEye is actively working with Apple experts on the issue, but it seems that only with the next iOS update will fix it.

“We have created a proof-of-concept “monitoring” app on non-jailbroken iOS 7.0.x devices. This “monitoring” app can record all the user touch/press events in the background, including, touches on the screen, home button press, volume button press and TouchID press, and then this app can send all user events to any remote server”. “Potential attackers can use such information to reconstruct every character the victim inputs.” “Based on the findings, potential attackers can either use phishing to mislead the victim to install a malicious/vulnerable app or exploit another remote vulnerability of some app, and then conduct background monitoring.” reported the official post. 

Apple vulnerability keylogger

Starting on the assumption that on iOS  application running in the background keeps on refreshing itself, the experts at FireEye noted that disabling iOS 7’s “Background App Refresh” setting it is possible to allow keylogging by a malicious app.

Apple vulnerability keylogger 2


“iOS7 provides settings for “background app refresh”. Disabling unnecessary app’s background refreshing contributes to preventing the potential background monitoring. However, it can be bypassed. For example, an app can play music in the background without turning on its “background app refresh” switch. Thus a malicious app can disguise itself as a music app to conduct background monitoring.”

Last month, Security researcher Neal Hindocha was developing a Screenlogging malware for the IOS and Android that logs finger swipes on smart devices in combination with taking screenshots.

How to mitigate the risks related to the exploitation of the Apple vulnerability?

Waiting for the next iOS update users have to carefully monitor the unnecessary applications running on their device via Task Manager.

“Before Apple fixes this issue, the only way for iOS users to avoid this security risk is to use the iOS task manager to stop the apps from running in the background to prevent potential background monitoring. iOS7 users can press the Home button twice to enter the task manager and see preview screens of apps opened, and then swipe an app up and out of preview to disable unnecessary or suspicious applications running on the background”  suggest researcher at FireEye.

Pierluigi Paganini

(Security Affairs –  Apple vulnerability, mobile)

From → Hacking, Security

Comments are closed.