A new CSS-based web attack will crash and restart your iPhone • Hacker News Board

Re: A new CSS-based web attack will crash and restart your iPhone

#21

Post by unilynx » Sun, Sep 16, 2018, 8:43 AM UTC

exikyut wrote: post #13

From the twitter thread - This is a full kernel panic; I wonder if it's exploitable (...probably not) - Someone's iPhone didn't ask for their PIN on reboot? - It apparently crashes watchOS 5 too

Some reboots on iPhone (including if you force it yourself by holding HOME + Power on iPhone 6) don't relock the SIM card, so that might be the "PIN" that was missing.

Re: A new CSS-based web attack will crash and restart your iPhone

#22

Post by joering2 » Sun, Sep 16, 2018, 8:44 AM UTC

avip wrote: post #10

matthberg wrote: post #3

The tweet announcing it: https://twitter.com/pwnsdx/status/1040944750973595649 The code that causes the crash (safe to open): https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33... The demo itself (causes crash): https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33a...

It works!

DO NOT CLICK THE LINK! Hour later I am still unable to restart my phone. It hangs on logo!! This may be a permanent fuck ;( unsure exact version but I have iOS 7 that hasnt been updated in about six months.

Re: A new CSS-based web attack will crash and restart your iPhone

#23

Post by zuppy » Sun, Sep 16, 2018, 8:47 AM UTC

joering2 wrote: post #22

avip wrote: post #10

Earlier quoted context omitted.

It works!

DO NOT CLICK THE LINK! Hour later I am still unable to restart my phone. It hangs on logo!! This may be a permanent fuck ;( unsure exact version but I have iOS 7 that hasnt been updated in about six months.

try a force restart (home + power button for about 10 seconds)

Re: A new CSS-based web attack will crash and restart your iPhone

#24

Post by zuppy » Sun, Sep 16, 2018, 8:48 AM UTC

avip wrote: post #10

matthberg wrote: post #3

The tweet announcing it: https://twitter.com/pwnsdx/status/1040944750973595649 The code that causes the crash (safe to open): https://gist.github.com/pwnsdx/ce64de2760996a6c432f06d612e33... The demo itself (causes crash): https://cdn.rawgit.com/pwnsdx/ce64de2760996a6c432f06d612e33a...

It works!

works on iOS 12 GM also

Re: A new CSS-based web attack will crash and restart your iPhone

#25

Post by tannhaeuser » Sun, Sep 16, 2018, 8:49 AM UTC

joering2 wrote: post #22

avip wrote: post #10

Earlier quoted context omitted.

It works!

DO NOT CLICK THE LINK! Hour later I am still unable to restart my phone. It hangs on logo!! This may be a permanent fuck ;( unsure exact version but I have iOS 7 that hasnt been updated in about six months.

Seems like on restart Safari wants to revisit previously opened pages and crashes again ad infinitum. Isn't there a way to cold-restart iOS devices or some such (like the magic "Zap NVRAM and repair permissions" procedure back in PowerMac times)?

Re: A new CSS-based web attack will crash and restart your iPhone

#26

Post by seddin » Sun, Sep 16, 2018, 8:51 AM UTC

I have tried it on a iPad Mini with iOS 8.4 (jailbroken) and it does nothing.

Re: A new CSS-based web attack will crash and restart your iPhone

#27

Post by howdydoo » Sun, Sep 16, 2018, 9:05 AM UTC

sebazzz wrote: post #2

I have always wondered why Safari crashes can reboot the entire telephone. Doesn't iOS have multiple protection rings or is Safari running at ring 0? Or is it a precaution that inhibits jailbreak research?

Safari on iOS reminds me of Windows 95 and Active Desktop. Whenever IE crashed, it took the entire shell (explorer.exe) down with it.

Re: A new CSS-based web attack will crash and restart your iPhone

#28

Post by sneak » Sun, Sep 16, 2018, 9:06 AM UTC

ben-schaaf wrote: post #12

avip wrote: post #11

Earlier quoted context omitted.

It also crashes chrome on iphone.

The underlying browser for chrome on iOS is still safari. The same is true for every other browser.

...however Chrome does not have the same privileges to run accelerated js on iOS that Safari does. Interestingly though this attack has nothing to do with javascript.

Re: A new CSS-based web attack will crash and restart your iPhone

#29

Post by panic » Sun, Sep 16, 2018, 9:08 AM UTC

fulafel wrote: post #5

sebazzz wrote: post #2

I have always wondered why Safari crashes can reboot the entire telephone. Doesn't iOS have multiple protection rings or is Safari running at ring 0? Or is it a precaution that inhibits jailbreak research?

It's prudent to reboot when a privileged component crashes, since the integrity of the code execution has been compromised. A lot of the time a DoS bug in native code is synonymous with "nobody bothered to craft a RCE". It's unintuitive to many people how many scenarios eventually allow a RCE exploit to be crafted. Check out some null pointer deref RCE's to convince yourself.

That may be true, but it's unrelated to what's happening here. If you've ever seen a "there was a problem with this page" bar appear, that was a Safari process crashing without bringing down the system (or even the browser UI process). The crash here is happening at a lower level.

Re: A new CSS-based web attack will crash and restart your iPhone

#30

Post by sneak » Sun, Sep 16, 2018, 9:10 AM UTC

exikyut wrote: post #13

From the twitter thread - This is a full kernel panic; I wonder if it's exploitable (...probably not) - Someone's iPhone didn't ask for their PIN on reboot? - It apparently crashes watchOS 5 too

It didn’t ask for their sim PIN, which is expected if the sim does not lose power, like in a full reboot without power off (eg kernel panic auto restart).

This is not to be confused with iOS unlock. SIM PINs are not commonly used in the USA.