March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
January 4, 2022
Rewterz Threat Alert – Coper Banking Trojan – Active IOCs
January 4, 2022
Rewterz Threat Alert – IcedID banking Trojan – Active IOCs
January 4, 2022
Rewterz Threat Alert – Coper Banking Trojan – Active IOCs
January 4, 2022
Severity
Medium
Analysis Summary
A newly found Denial of Service vulnerability named doorLock has been discovered in the Apple Homekit. Homekit is a software that helps iOS/iPadOS users communicate with, control, and configure their smart-home appliances. These devices are automatically discovered because of Homekit.
Trevor Spiniolas is the security researcher that publicly disclose the vulnerability but he suspects Apple knew about it since August of 2021.
I believe this bug is being handled inappropriately as it poses a serious risk to users and many months have passed without a comprehensive fix. The public should be aware of this vulnerability and how to prevent it from being exploited, rather than being kept in the dark. – Spiniolas.
Device names can be configured and changed using this vulnerability and then iCloud updates the device name across all iOS devices. This data is then updated frequently without user interaction.
If the device does not have Home devices enabled in Control Center then the Home app will crash and become unusable. If the device does have Home devices enabled in Control Center (which is the default behavior) the iOS will become unresponsive.
Impact
- Denial of Service
Affected Vendors
- Apple
Affected Products
- Apple Homekit iOS 14.0 and later
Remediation
- Restore the affected device from Recovery or DFU Mode.
- Setup the device without signing into the iCloud account.
- After completing setup, sign into the iCloud from settings.
- Disable Show Home Controls.