Hackers could be exploited a vulnerability in the iOS Camera App to redirect users to a malicious website, the issue affects the built-in QR code reader.
According to information security training researchers, the iOS Camera App is affected by a bug that could be exploited by hackers to redirect users to a malicious website; the issue resides in the built-in QR code reader. The vulnerability affects the latest Apple iOS 11 for iPhone, iPad, and iPod touch devices.
The problem ties a new feature that was implemented in iOS 11 to allow users to automatically read QR codes while using the camera app without requiring any third-party QR code reader app.
To read a QR code, users need to open the Camera app on their Apple devices and point the iPhone or the iPad at a QR code, in this way if the code and URL, the system will give the users a notification with the link address. Tapping the notification the users can visit the URL in Safari browser, but according to the information security researcher Roman Mueller who discovered the vulnerability, the URL visited could be changed.
The information security training expert discovered that the URL parser of built-in QR code reader for iOS camera app doesn’t correctly detect the hostname in the URL making it possible to change the displayed URL in the notification and hijacking to users to malicious websites.
“The URL parser of the camera app has a problem here detecting the hostname in this URL in the same way as Safari does.” wrote the expert in a post.
“It probably detects “xxx\” as the username to be sent to “facebook.com:443”.
While Safari might take the complete string “xxx\@facebook.com” as a username and “443” as the password to be sent to infosec.rm-it.de.”
“This leads to a different hostname being displayed in the notification compared to what actually is opened in Safari.”
Mueller created a QR code containing the following URL: https://xxx\@facebook.com:443@infosec.rm-it.de/
When he scanned it he noticed that the device was showing the following notification: Open “facebook.com” in Safari
Once tapped it opened https://infosec.rm-it.de/ instead Facebook. The expert successfully tested the issue on his iPhone X running iOS 11.2.6.
The information security training researcher had already reported this flaw to Apple in December last year, but Apple hasn’t yet fixed the bug to the date. The vulnerability is very dangerous and opens the doors to numerous attack scenarios. Mueller reported the vulnerability to the Apple security team.
Working as a cyber security solutions architect, Alisa focuses on application and network security. Before joining us she held a cyber security researcher positions within a variety of cyber security start-ups. She also experience in different industry domains like finance, healthcare and consumer products.
