Zero-Day iOS HomeKit Vulnerability Allowed Remote Access To Smart Accessories Including Locks

Apple has issued a fix to a vulnerability that allowed unauthorized control of accessories, including smart locks and garage door openers. "Our understanding is Apple has rolled out a server-side fix that now prevents unauthorized access from occurring while limiting some functionality, and an update to iOS 11.2 coming next week will restore that full functionality," reports 9to5Mac. From the report: The vulnerability, which we won't describe in detail and was difficult to reproduce, allowed unauthorized control of HomeKit-connected accessories including smart lights, thermostats, and plugs. The most serious ramification of this vulnerability prior to the fix is unauthorized remote control of smart locks and connected garage door openers, the former of which was demonstrated to 9to5Mac. The issue was not with smart home products individually but instead with the HomeKit framework itself that connects products from various companies. The vulnerability required at least one iPhone or iPad on iOS 11.2, the latest version of Apple's mobile operating system, connected to the HomeKit user's iCloud account; earlier versions of iOS were not affected.

smart

[Neuronwelder]

Why do they use the word "smart" when using the public Web to control a private home?

Re:

[TheRaven64]

It's not just about security, it's about visibility. The easiest way to break into my house is to throw a brick through the window. The problem with doing that, as a burglar, is that the lawful owner of the house would probably not do that and so it's likely that someone else would call the police. It also leaves evidence of unlawful entry, so even if no one sees you throw the brick, someone might notice the big hole in the window and report it.

A better thief might buy a set of lockpicks, learn how to p

Re:

[Neuronwelder]

To add to what you said: What to prevent the video from being interrupted and not seeing the person breaking into a house?

Re:

[gravewax]

Any company that can convince people to put the control of their lives into the hands of the public has to be pretty fucking smart, at least smarter than the actual purchaser.

Re:

[Neuronwelder]

Thank you. They can sell you manure if they package it right. Just put a flashy commercial on the TV.

Re:

[ls671]

Thanks, I couldn't believe my understanding of TFS but you seem to confirm it was correct.

Reported in October

[Anonymous Coward]

According to the article, Apple was informed of the vulnerability in October and won't be releasing a patch until next week. The patch is only coming out that "soon" because 9to5Mac is reporting on it, much like the "empty password for root" bug was reported to them weeks ago but only fixed when it went "viral" on Twitter.

It's clear that Apple is taking Microsoft's stance of security from the 90s: they don't care about it.

Re:

[Hal_Porter]

Apple have never really taken security seriously. Remember how when iPhones came out Apple fans claimed Apple was more secure and also that the iPhone being locked down wasn't a problem because you could jailbreak it by visiting a site with a malformed TIFF [wikipedia.org]?

This was in 2007, five years after Microsoft's focus on security initiative. [neowin.net]

Re:

[Anonymous Coward]

hal porter doesn't even take the history of company security seriously. He just dislikes apple, given his comment history anyone can see that. The truth is few take security at all seriously.

Re: Reported in October

[Hal_Porter]

My main laptop is a Mid 2012 Macbook Pro these days. I like it and would have upgraded it if it weren't for soldered Ram and SSD in the newer models.

Re:

[ls671]

Apple have never really taken security seriously...

I am not trying to defend apple here since there is no excuse but seriously, very few people take security seriously nowadays even where one would expect people in charge of a given organization to do so.

I remember a default value for an organization field being "not_organized" somewhere, I think it was in certificate requests but I am not sure ;-)

In a technologically advanced society, maybe IT security topic knowledge should be made mandatory before going to high school.

Re:

[TheRaven64]

Remember how when iPhones came out Apple fans claimed Apple was more secure and also that the iPhone being locked down wasn't a problem because you could jailbreak it by visiting a site with a malformed TIFF

And almost 10 years after that, Android phones were shipping with a vulnerability in the media framework, which ran in a separate process with root privilege (WTF?!?) that allowed any web site to run malicious code as root and then compromise the kernel. And it took over six months between the vulnerability being made public (and even given the buzzwordy name StageFright) and more than 50% of Android phones being patched, in spite of the Android developers having the experience of the iOS vulnerability to

Re:

[tlhIngan]

According to the article, Apple was informed of the vulnerability in October and won't be releasing a patch until next week. The patch is only coming out that "soon" because 9to5Mac is reporting on it, much like the "empty password for root" bug was reported to them weeks ago but only fixed when it went "viral" on Twitter.

Only if you want to misreport it as "a patch to fix it".

No, it's fixed already. You cannot exploit this. The fixes were applied all over the place - a lot of patches were applied to Apple'

The fact that Zero Days in the Home are a thing

[Anonymous Coward]

Is damn good reason enough to NOT use these things in your home, unless your family safety means jack shit.

Re:

[ls671]

No, no, it is a very good technology when you know what you are doing. Contact me offline for further requests,
I run an hyper-Z omega secretive cloud that will take care of all your security needs, 100% hacker proof, guaranteed! We are also fully compatible with all the Apple apps!

Re:

[JustAnotherOldGuy]

I run an hyper-Z omega secretive cloud that will take care of all your security needs, 100% hacker proof, guaranteed!

Can I upgrade to the 120% hacker-proof version for an extra $100??

Remember this, fans of Amazon.com's eHomeRobbery

[jbn-o]

Those who were defending amazon.com's hardware+service to allow amazon.com to deliver items inside your home should remember this: software you don't exclusively control, can't vet, and aren't allowed to inspect, fix, or share (thus your willingness to do these things is moot) means you're not just trusting an unknowable number of people to open your door and do stuff in your home while everyone is away. Your home security and your privacy is also subject to security problems anywhere in the amazon.com syst

Re:

[TheRaven64]

Not being able to vet it doesn't mean much. I doubt that there are 100 people in the world who can audit software of this complexity and be confident that it is free from security bugs. For anyone else, it should be assumed to be insecure whether you have the code or not.

Re:

[TheRaven64]

Okay, please point to one single piece of off-the-shelf software that anyone has audited well enough to stand up in public and assert that it is bug free. The closest I can think of is seL4, which was not just published, it was written with formal verification in mind: if you just had the C sources for it (and not the accompanying proofs) then verification would be a many man-year project. Oh, and it was less than a day between the public release of seL4 and the first security vulnerability being found.

P

Re:

[tlhIngan]

Those who were defending amazon.com's hardware+service to allow amazon.com to deliver items inside your home should remember this: software you don't exclusively control, can't vet, and aren't allowed to inspect, fix, or share (thus your willingness to do these things is moot) means you're not just trusting an unknowable number of people to open your door and do stuff in your home while everyone is away. Your home security and your privacy is also subject to security problems anywhere in the amazon.com syst

Re:

[tlhIngan]

Here's more information on HomeKit versus Alexa.

https://www.reuters.com/articl... [reuters.com]

root

[crimson tsunami]

Do you just walk up to the front door and say you are Root?
Or is there a handle you have to hold wrong first?

Microsoft version no better

[crimson tsunami]

You walk up to the front door and it tells you your house is updating to creators edition. You have to wait outside in the snow a few hours before you can go inside.

Shocking

[JustAnotherOldGuy]

IoT shit is insecure? Nooooooooo!

Shocking, I say! For further proof, this is my shocked face.