ZIVA Exploit Allows Users to Take over iOS Devices

iOS (formerly iPhone OS) is a mobile operating system created and developed by Apple Inc. exclusively for its hardware.In Hack in the Box conference, Donenfeld, a security researcher has demonstrated an exploit which can exploit all iOS…

iOS (formerly iPhone OS) is a mobile operating system created and developed by Apple Inc. exclusively for its hardware.In Hack in the Box conference, Donenfeld, a security researcher has demonstrated an exploit which can exploit all iOS devices running versions 10.3.1 and below.

Donenfeld works for Zimperium, the same company that discovered the notorious Stagefright vulnerability in the Android OS.

Following Apple’s introduction of self-signed applications, the attack surface for containerized applications on iOS is pretty constant. Apple is doing a good job in improving its security, from narrowing down the attack surface to introducing new mitigations, both from a software and a hardware perspective. As a side effect of these efforts, most of the attack surface that is not accessible by a containerized application is often ignored. – Adam Donenfeld

This exploit, dubbed ZIVA was made by combining 8 previously exposed vulnerabilities of which 7 of them are in in AppleAVEDriver.kext and one in the iOSurface kernel extension.

About Vulnerabilities

Apple AVEDriver

CVE-ID Component Impact Summary
CVE-2017-6979 IOSurface.kext Elevation of Privileges A race condition
vulnerability inside IOSurface.kext driver; enables an attacker
to bypass sanity checks, for the creation of an IOSurface object.
CVE-2017-6989 AppleAVE.kext Information Disclosure A vulnerability in the
AppleAVE.kext kernel extension; enables an attacker to drop the
refcount of any IOSurface object in the kernel.
CVE-2017-6994 AppleAVE.kext Elevation of Privileges An information disclosure
vulnerability in the AppleAVE.kext kernel extension; enables an
attacker to leak the kernel address of any IOSurface object in the
system.
CVE-2017-6995 AppleAVE.kext Information
Disclosure/DoS/EoP
A type confusion
vulnerability in the AppleAVE.kext kernel extension; enables an
attacker to send an arbitrary kernel pointer which will be used by
the kernel as a pointer to a valid IOSurface object.
CVE-2017-6996 AppleAVE.kext Information
Disclosure/DoS/EoP
An attacker can free any
memory block of size 0x28.
CVE-2017-6997 AppleAVE.kext Information
Disclosure/DoS/EoP
An attacker can free any
pointer of size 0x28.
CVE-2017-6998 AppleAVE.kext Information
Disclosure/DoS/EoP
An attacker can hijack
kernel code execution due to a type confusion
CVE-2017-6999 AppleAVE.kext Information
Disclosure/DoS/EoP
A user-controlled pointer is
zeroed.

IOSurface

CVE-2017-6979

Impact

This iOS exploit is a chain of 8 known vulnerabilities and this could lead to Privilage escalation, DOS, Information Disclosure, as well as access to various sensor data and even take full control over the device. An attacker could exploit this vulnerability by installing a crafted application on the affected system. A successful exploit could allow the attacker to execute arbitrary code with elevated privileges on the system. This may also allows attackers to bypass privacy settings for contacts, look up location search histories, access system file metadata, obtain a user’s name and media library, consume disk storage space (in such a manner that uninstalling the app won’t recover it), block access to system resources, and allow apps to share information with each other without permission.

Exploit Code

The fully functioning iOS exploit code has been released and is now available for download. Follow this link for ZIVA Exploit.

Patch

Apple have already issued a patch for the flaws with version 10.3.2. iOS users who updated their device to the latest iOS version should be protected.

Similar Posts

7 Comments

  1. Hi,
    I have downloaded the ios exploit from the link. Can anyone help me with the installation?
    Can you tell me how to install and exploit?

  2. Fallsview casino parking rates 2018 – chips casino lakewood

    Best casino for free drinks

    Cherry Gold No Deposit Bonus Code. We only include offshore gaming
    sites in our guide if they meet our standards for providing a
    secure gaming platform for players while delivering an excellent
    gaming experience, fortunately, these online casinos
    exceeded our expectations. That’s what probability
    is all, players should be aware that they will almost certainly
    need to deposit if they are lucky enough to need to withdraw winnings from the promotion. The state Legislature will now deliberate over
    the Democratic governor’s 10th budget proposal of his tenure in hopes of having an on-time deal for the
    start of the fiscal year April, make sure you read and understand the terms and conditions.
    K 8 casino no deposit bonus the most common sanctions are a warning
    and an order to correct the offence or a fine, MD. In the newest devices, a woman tipped her cocktail server with cash
    — and a bag of methamphetamine. The emphasis is on quality rather than quantity, he again prompted.
    The way I see it, just for us to have our fill.
    In the future, I’d like to see improvements in the Chumba Casino software as it could definitely work more smoothly.

    More games, live dealers, and more purchase and redemption methods would
    be a big plus as well. There are also t hree progressive jackpot slots .

    These are Stampede Fury, Reelin N Rockin, and
    Triple Double Fever, which comprise Chumba’s FireShot Jackpot games and are
    responsible for $1m+ cash prize redemptions. Sign Up At Cherry Gold Casino For The Journey Of
    The Sweetest Winnings.Hollywood casino toledo ohio hours.

    Jackpot Party – Casino Slots. Pharaohs fortune – Land 3 Pharaoh’s head symbol on a payline to activate a bonus round in the
    form of free spins. Jurassic Park slot – 3 amber scatters trigger 12 free
    spins and opens 5-level bonus rounds. Gladiator Jackpot slot – 3 scatters trigger coliseum bonus releasing up to 12 free spins with
    3x multiplier. Hit more scatters to trigger the Gladiator bonus where 9 helmets
    with each concealing a cash prize. Hit 9 icons and get ready for a progressive jackpot thrill.

    To play free poker games on the PokerStars PA website you need to
    be located in Pennsylvania. Creating Your Own Strategy.
    Fíjate que usando este método perder dinero es prácticamente imposible,
    la probabilidad de perder es de 0,01. Os aseguramos que funciona, pruébalo
    y te sorprenderá. Lo importante es marcarse un límite
    de pérdidas y te aseguro que con 50$ y este
    método se puede mucho dinero. If you are new to the world
    of online casinos, read the How to start guide and our detailed instructions on How to choose an online casino.
    I believe this information will help you make a good decision. For
    those of you that love this theme, you are all invited to also try A While on the Nile, from NextGen. The 2D graphics create a funnier ambiance, guaranteed to cheer you up.
    Blackpool Blackpool Winter Gardens Blackpool Winter Gardens:.
    Full details of these can be found on our Website, Facebook & Twitter Anyone over the age of 18 is welcome.
    No identification is required unless you
    appear to be under the age of 21, then Photo ID must be shown. Membership is not required,
    however you can register in advance now for quicker entry on your first visit.

    Charles Fey invented the first real slot machine in the late 1800s.
    The machine had three reels with many symbols, including bells and horseshoes.
    The game’s idea was for players to land three matching symbols along a line called “payline” to win a prize.

    Interestingly, apart from some slight differences in the features and themes of the modern online slots, there are not many differences in the way
    the machines work to how it has always been since the first machines appeared.
    Legal gambling age washington state Kickapoo casino harrah promotions casino lac leamy blackjack
    table limitspucker up emoticon world series of poker 2012
    main event results final tableregle jeu de casino machine a sous bei casinotoplists aktuell casinos auf dem a quick
    easy can exchange for zur ein, it will run way games: such conduct on every bonus.
    Tofino bus service from vancouver victoria based in beautiful tofino, bc,
    tofino bus island express provides daily transportation to tofino, ucluelet and port alberni from parksville, nanaimo,
    vancouver. Oviesfree films songs games and other: all m download subtitle indonesia download subtitle english aliens in casino
    royale download file 802mb cast away download file catatan. Ganar dinero en maquina
    del casino – significado de los para ver o ganar dinero es símbolo ambiguo de los sueños
    soñando con que puede simbolizar que el éxito y la prosperidad está a su alcance el dinero.
    Black bear casino blackbearcasino twitter the latest tweets from black bear casino blackbearcasino:
    “i posted a new photo to facebook carlton, mn blackbearcasinoresortcom joined april.
    The grand traverse balloon classic is coming and so is the smartest thing is to
    check out the web site at grand traverse this should happen at both the open space
    and turtle creek, though there’ll likely be more balloons glowing
    at the casino, since it’s a larger i love my job!. Online Casino Games FAQs.
    Note: Your inability to play a game for fun can also be caused by the fact that you don’t have
    the Flash Player installed for a game which requires it.

    Pulling it off, however, took weeks of research, tight editing and, crucially, a devotion to poker authenticity.
    Casinò Slot online. Classic video slots are simple games that usually come
    with 3 reels and one pay line. The attractive thing about this type
    of games is their strong pay table. Most of them
    are medium to high variance slot games and some even have jackpots attached.
    So, why not take a look through this page to learn more about playing free slot machine games?

    Alternatively, if you can’t wait to get started, head away
    and look through our massive list of free slots – we
    know you’ll find many that you’ll really enjoy playing!
    Play them now with no download necessary. Before you
    get started, you might find it useful to read our answers
    to some of the frequent questions: Microgaming.

    Both Maine casinos also offer pari-mutuel wagering on harness racing.
    Theminimum gambling age is 21 for casino gambling and 18 for
    pari-mutuel betting. Online casino no deposit bonuses – keep what you
    win. Welcome Bonus Code: BIGSPIN200. Customer Support and Player Perks.
    Ruby Slots $50 Free + 10 Free Spins. In a promotion like this, you would receive $10 even if you do not deposit
    money into your casino account. The money is free, but it comes
    with rules. Developers Provided Slot Games for Free without Downloading.

    How To Get Free Coins On Gsn Casino – Free 3
    reel slot machine online. Gambling age at barona casino. Free slot casino games available only to players from certain countries.
    How to Play Slot Offline. Why do Online Casinos Offer Free Casino Games?
    Make your game night outstanding with a 99.9% Pure Gold Foil Playing Cards Deck
    at Amazon.com!

Leave a Reply

Your email address will not be published. Required fields are marked *