Flipper Zero can be used to crash iPhones running iOS 17
1–10 of 38 posts
Re: Flipper Zero can be used to crash iPhones running iOS 17
#2I mentioned this in the past -- that apparently Apple puts more effort in authenticating replacement parts for the iPhone than it does for authenticating wireless devices which pretend to be an Apple device.
Re: Flipper Zero can be used to crash iPhones running iOS 17
#3I mentioned this in the past -- that apparently Apple puts more effort in authenticating replacement parts for the iPhone than it does for authenticating wireless devices which pretend to be an Apple device.
From the perspective of profit incentives, this makes perfect sense
Re: Flipper Zero can be used to crash iPhones running iOS 17
#4I mentioned this in the past -- that apparently Apple puts more effort in authenticating replacement parts for the iPhone than it does for authenticating wireless devices which pretend to be an Apple device.
That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. My trust model doesn't include them to begin with. And to the extent that my OS trusts those devices, at least any bugfixes can be pushed via software update.
As the article notes, there is a simple way to stop this attack, which is to disable bluetooth. I already do that by default.
Re: Flipper Zero can be used to crash iPhones running iOS 17
#5I mentioned this in the past -- that apparently Apple puts more effort in authenticating replacement parts for the iPhone than it does for authenticating wireless devices which pretend to be an Apple device.
You know that authenticating something is a very simple and self contained operation right? Like it’s not hard to do it without memory safety issues. The overwhelming majority of attacks on cryptography are poor protocols, not anything else.
Parsing arbitrary attacker provided data on the other hand is hard. I would guess the there’s an incorrect assumption that Bluetooth (and similar) radios are legitimate fcc approved hardware that isn’t actively malicious. I would suspect that if people put any thought into it they could do similar to any other Bluetooth device.
Re: Flipper Zero can be used to crash iPhones running iOS 17
#6I mentioned this in the past -- that apparently Apple puts more effort in authenticating replacement parts for the iPhone than it does for authenticating wireless devices which pretend to be an Apple device.
That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. My trust model doesn't include them to begin with. And to the extent that my OS trusts those devices, at least any bugfixes can be pushed via software update. As the article notes, there is a simple way to stop this attack, which is to dis…
But your iPhone trusts these devices.
> there is a simple way to stop this attack, which is to disable bluetooth
This doesn't work, I've already tried it with my iPhone and a friend's Flipper.
Re: Flipper Zero can be used to crash iPhones running iOS 17
#7I mentioned this in the past -- that apparently Apple puts more effort in authenticating replacement parts for the iPhone than it does for authenticating wireless devices which pretend to be an Apple device.
That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. My trust model doesn't include them to begin with. And to the extent that my OS trusts those devices, at least any bugfixes can be pushed via software update. As the article notes, there is a simple way to stop this attack, which is to dis…
> That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control.
You are more concerned with someone opening your iPhone and putting a replacement malicious part than with someone pwning your iPhone with a $5 wireless device while in his car just driving by ?
Your threat model is upside down.
Re: Flipper Zero can be used to crash iPhones running iOS 17
#8Earlier quoted context omitted.
That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. My trust model doesn't include them to begin with. And to the extent that my OS trusts those devices, at least any bugfixes can be pushed via software update. As the article notes, there is a simple way to stop this attack, which is to dis…
> That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. You are more concerned with someone opening your iPhone and putting a replacement malicious part than with someone pwning your iPhone with a $5 wireless device while in his car just driving by ? Your threat model is upside down.
I would be very concerned with someone pwning my phone with a $5 wireless device, but that's not what's happening here. This is a DoS attack. It could never be perfectly mitigated, as long as any mitigation depends on the (arguably) fundamentally impossible task of verifying an external device is a "real" Apple device. It's possible to design security protocols that allow me to verify my device is a real Apple device, but likely not to verify a packet was sent by someone else's "real" Apple device. So I'm less concerned about the latter.
Also note that I specified I'm more concerned with verification of trusted hardware on my own device. Because the repercussions of malicious hardware implanted in my own device cannot be mitigated purely in software. Whereas verifying the integrity of an external device inherently depends solely on software, since there is no hardware interaction. I'm still concerned about it, in the sense that I'd like my OS to take best efforts to only "trust" external devices insofar as it can verify they're trustable, but I also accept that those devices are outside of my control and so any protocol for trusting them will have holes in it. My main requirement is that I should be able to opt out of the system if possible (by e.g. disabling bluetooth).
Re: Flipper Zero can be used to crash iPhones running iOS 17
#9Earlier quoted context omitted.
That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. My trust model doesn't include them to begin with. And to the extent that my OS trusts those devices, at least any bugfixes can be pushed via software update. As the article notes, there is a simple way to stop this attack, which is to dis…
But your iPhone trusts these devices. > there is a simple way to stop this attack, which is to disable bluetooth This doesn't work, I've already tried it with my iPhone and a friend's Flipper.
Interesting. Turning bluetooth off via settings doesn't mitigate it? What about disabling AirDrop and Find My?
Re: Flipper Zero can be used to crash iPhones running iOS 17
#10Earlier quoted context omitted.
> That's fine. I'm more concerned that the (replacement) hardware on my own device is not malicious, than I am with the hardware on other devices that are already outside my control. You are more concerned with someone opening your iPhone and putting a replacement malicious part than with someone pwning your iPhone with a $5 wireless device while in his car just driving by ? Your threat model is upside down.
I would be very concerned with someone pwning my phone with a $5 wireless device, but that's not what's happening here. This is a DoS attack. It could never be perfectly mitigated, as long as any mitigation depends on the (arguably) fundamentally impossible task of verifying an external device is a "real" Apple device. It's possible to design security protocols that allow me to verify my device is a real Apple device…
> This is a DoS attack. It could never be perfectly mitigated
Bullshit.
Flooding the waves with radio interference (something that Bluetooth is particularly resistant to) would at most "deny service" of another device trying to connect to my iPhone through Bluetooth. It should NOT deny service of the _entire_ iPhone, which is what is discussed here. This is 100% preventable crap.
> the (arguably) fundamentally impossible task of verifying an external device is a "real" Apple device
Bullshit... and egregious considering you apparently think it is doable for replacement parts, but "fundamentally impossible" for networking devices. SSL is about 30 years old by now.
> I'm still concerned about it, in the sense that I'd like my OS to take best efforts to only "trust" external devices insofar as it can verify they're trustable, but I also accept that those devices are outside of my control and so any protocol for trusting them will have holes in it.
Also bullshit. All these holes are because of the proprietary extensions Apple puts on top of Bluetooth, which are exploited to no end. Notice my original post is about Apple not being able to identify when it is a (real vs fake) Apple device that is trying to initiate a connection. The protocol is 100% controlled by Apple.
Normal Bluetooth protocols and devices (which do not identify as Apple devices and are therefore subject to the standard Bluetooth pairing UI) are almost never the problem.