The security researcher Qixun Zhao of Qihoo 360’s Vulcan Team has published a PoC exploit code for critical vulnerabilities in Apple Safari web browser and iOS that could be exploited by a remote attacker to jailbreak an
The exploitation of the flaw is quite simple, the attacker needs to trick victims into opening a specially crafted web page using Safari browser.
The PoC code developed by Qixun Zhao, dubbed Chaos, chains two security flaws that were demonstrated at TianfuCup hacking contest in November.
The Safari vulnerability allowed maliciously crafted web content to execute arbitrary code on the targeted device, which then the second one allowed to elevate privileges and silently deploy a malicious application
Zhao published a blog post that includes some details for the exploit code, the expert also shared a PoC video demonstration for it.
Zhao hasn’t published the exploit code for the iOS jailbreak to prevent attacks in the wild.
“I will not release the exploit code, if you want to jailbreak, you will need to complete the exploit code yourself or wait for the jailbreak community’s release. At the same time, I will not mention the exploit details of the post exploit, as this is handled by the jailbreak community,” Zhao said.
iPhone users urge to install the latest iOS update as soon as possible,
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.