• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
January 4, 2022
Rewterz Threat Alert – Coper Banking Trojan – Active IOCs
January 4, 2022

Rewterz Threat Advisory – doorLock Vulnerability Affecting Apple Homekit

January 4, 2022

Severity

Medium

Analysis Summary

A newly found Denial of Service vulnerability named doorLock has been discovered in the Apple Homekit. Homekit is a software that helps iOS/iPadOS users communicate with, control, and configure their smart-home appliances. These devices are automatically discovered because of Homekit. 

Trevor Spiniolas is the security researcher that publicly disclose the vulnerability but he suspects Apple knew about it since August of 2021. 

I believe this bug is being handled inappropriately as it poses a serious risk to users and many months have passed without a comprehensive fix. The public should be aware of this vulnerability and how to prevent it from being exploited, rather than being kept in the dark. – Spiniolas.

Device names can be configured and changed using this vulnerability and then iCloud updates the device name across all iOS devices. This data is then updated frequently without user interaction. 

If the device does not have Home devices enabled in Control Center then the Home app will crash and become unusable. If the device does have Home devices enabled in Control Center (which is the default behavior) the iOS will become unresponsive.

Impact

  • Denial of Service

Affected Vendors

  • Apple

Affected Products

  • Apple Homekit iOS 14.0 and later

Remediation

  • Restore the affected device from Recovery or DFU Mode.
  • Setup the device without signing into the iCloud account.
  • After completing setup, sign into the iCloud from settings.
  • Disable Show Home Controls.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.