Pangu Research Lab has discovered a common type of security exploit during iOS app security audits targeting different customers. After creating the exploit signature, they conducted traceability analysis and similar exploit index on the Janus platform and found that about 10% of iOS apps may be affected by the security flaw.
Once a user downloaded and use these apps in an insecure WiFi environment; an attacker would able to arbitrary code execution in the app. After manual analysis, the research lab confirmed that apps like Weibo, Facebook Moments, Google for iOS, Google Translate, and so on are affected!
The so-called ZipperDown exploit is somewhat related to the affected app features and permissions. In some apps, attackers can only use it to corrupt or overwrite the app's data; however, in some apps, an attacker may able to acquire arbitrary code execution capability in the context of the app. Furthermore, the iOS system's sandbox will also limit the scope of the security flaw.
As of now, Pangu told us that they have tested 168,951 apps, and about 10% of the apps are vulnerable to it. The team also found a similar exploit on the Android platform and have confirmed it has already found on a large number of Android apps! Hopefully, Apple will soon issue a software update to fix the security flaw.
For more information, please visit ZipperDown.org
While auditing iOS Apps from various customers, Pangu Lab noticed a common programming error, which leads to severe consequences such as data overwritten and even code execution in the context of affected Apps. We created a signature for the issue and performed a large-scale search on our App analysis platform Janus. Surprisingly, we found thata round 10% iOS Apps might be affected by the same or similar issue
Once a user downloaded and use these apps in an insecure WiFi environment; an attacker would able to arbitrary code execution in the app. After manual analysis, the research lab confirmed that apps like Weibo, Facebook Moments, Google for iOS, Google Translate, and so on are affected!
The so-called ZipperDown exploit is somewhat related to the affected app features and permissions. In some apps, attackers can only use it to corrupt or overwrite the app's data; however, in some apps, an attacker may able to acquire arbitrary code execution capability in the context of the app. Furthermore, the iOS system's sandbox will also limit the scope of the security flaw.
As of now, Pangu told us that they have tested 168,951 apps, and about 10% of the apps are vulnerable to it. The team also found a similar exploit on the Android platform and have confirmed it has already found on a large number of Android apps! Hopefully, Apple will soon issue a software update to fix the security flaw.
For more information, please visit ZipperDown.org
Post a Comment