A new vulnerability that affects Apple’s iOS could be exploited by hackers to collect user passwords by using a single email.
Jan Soucek (@jansoucek) , a forensic expert at Ernst and Young has developed a tool, the iOS 8.3 Mail.app inject kit, that could be used to create malicious iCloud password phishing emails. The expert explained that he exploits an unpatched bug affecting Apple iOS.
“Ernst and Young forensic bod Jan Soucek has created a tool capable of generating slick iCloud password phishing emails he says exploits an unpatched bug affecting millions of Apple users.” states the Register.
The iOS 8.3 Mail.app inject kit exploits a vulnerability in the Apple operating system’s native email client that allows and attacker to display a realistic pop-up.
Soucek tried to contact the Apple, but he hasn’t received any reply from Cupertino since January.
“Back in January 2015 I stumbled upon a bug in iOS’s mail client, resulting in HTML tags in email messages not being ignored,” Soucek says.
Soucek discovered that Apple ignores a key line of code in incoming emails: <meta http-equiv=refresh>, this means that an attacker can remotely load arbitrary HTML content inside an email when victims open it on an iPhone, iPad or iPod.
“It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2.”
The attacker sends a malicious email that looks like it’s from a legitimate source, but instead it propose a realistic input form used to steal victim’s password.
Here’s a video PoC:
(Security Affairs – Apple iOS, hacking)
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.