Researchers have discovered a new post-exploit persistence technique on iOS 16 that allows attackers to maintain access to an Apple device even when it is believed to be offline [1] [3] [4] [5] [7].
Description
By manipulating the code controlling airplane mode [2] [6], attackers can deceive users into thinking their device is in airplane mode while still having access to the internet [2]. This technique involves planting an artificial signal to trick the victim into thinking their device’s Airplane Mode is working. The attackers modify the user interface to display airplane mode icons and cut off internet connection to all apps except their own [1] [3]. They utilize the CommCenter daemon to block cellular data access for specific apps and disguise it as Airplane Mode [3] [4] [5]. This allows them to maintain connectivity for their malicious payload [3]. Additionally, an SQL database in the CommCenter daemon records the cellular data access status of each app [3], enabling selective blocking or allowing of app access to Wi-Fi or cellular data [3]. These techniques require total control over the device and are only applicable for post-exploitation attacks [2] [6]. It is important to note that this technique has not yet been used in real-world attacks.
Conclusion
Defenders can use this knowledge to improve detections and potentially develop intelligent detection tools to identify compromised devices [6]. Apple has stated that this attack does not relate to a specific vulnerability in the operating system [5].
References
[1] https://thehackernews.com/2023/08/new-apple-ios-16-exploit-enables.html
[2] https://www.darkreading.com/endpoint/researchers-trick-iphone-faking-airplane-mode
[3] https://mrhacker.co/vulnerabilities/new-apple-ios-16-exploit-enables-stealthy-cellular-access-under-fake-airplane-mode
[4] https://cyber.vumetric.com/security-news/2023/08/17/new-apple-ios-16-exploit-enables-stealthy-cellular-access-under-fake-airplane-mode/
[5] https://vulners.com/thn/THN:62A23B2C2C7BC6FF6585560B3B0D576C
[6] https://www.threatshub.org/blog/researchers-trick-an-iphone-into-faking-airplane-mode/
[7] https://gixtools.net/2023/08/new-apple-ios-16-exploit-enables-stealthy-cellular-access-under-fake-airplane-mode/
