Pierluigi Paganini June 11, 2015

A security expert demonstrated how to exploit a vulnerability in Apple IOS system to steal user password with a phishing email.

A new vulnerability that affects Apple’s iOS could be exploited by hackers to collect user passwords by using a single email.

Jan Soucek (@jansoucek) , a forensic expert at Ernst and Young has developed a tool, the iOS 8.3 Mail.app inject kit, that could be used to create malicious iCloud password phishing emails. The expert explained that he exploits an unpatched bug affecting Apple iOS.

“Ernst and Young forensic bod Jan Soucek has created a tool capable of generating slick iCloud password phishing emails he says exploits an unpatched bug affecting millions of Apple users.” states the Register.

The iOS 8.3 Mail.app inject kit exploits a vulnerability in the Apple operating system’s native email client that allows and attacker to display a realistic pop-up.

Soucek tried to contact the Apple, but he hasn’t received any reply from Cupertino since January.

“Back in January 2015 I stumbled upon a bug in iOS’s mail client, resulting in HTML tags in email messages not being ignored,” Soucek says.

Soucek discovered that Apple ignores a key line of code in incoming emails: <meta http-equiv=refresh>, this means that an attacker can remotely load arbitrary HTML content inside an email when victims open it on an iPhone, iPad or iPod.

“This bug allows remote HTML content to be loaded, replacing the content of the original email message. JavaScript is disabled in this UIWebView, but it is still possible to build a functional password ‘collector’ using simple HTML and CSS.” said the researcher.

“It was filed under Radar #19479280 back in January, but the fix was not delivered in any of the iOS updates following 8.1.2.”

Attack scenario

The attacker sends a malicious email that looks like it’s from a legitimate source, but instead it propose a realistic input form used to steal victim’s password.

Here’s a video PoC:

Pierluigi Paganini

(Security Affairs – Apple iOS, hacking)