Apple patches iOS captive portal bug that let hackers impersonate victims onlineAn iOS bug that allowed malicious agents to impersonate end users' identities by granting read/write access to website cookies was fixed with the release of iOS 9.2.1 on Tuesday, some two and a half years after it was first reported to Apple.
According to security firm Skycure, the iOS flaw involved a shared cookie store installed between Safari and embedded browsers used to facilitate "captive portals" like those employed by gated Wi-Fi networks at coffee shops, hotels and other public locales, reports ArsTechnica.
Armed with resources gleaned from the shared cookie store, attackers had free rein to impersonate end users online, force victims to log into an unwanted account without their knowledge or trigger malicious code.
This issue allows an attacker to:
- Steal users' (HTTP) cookies associated with a site of the attacker's choice. By doing so, the attacker can then impersonate the victim's identity on the chosen site.
- Perform a session fixation attack, logging the user into an account controlled by the attacker-because of the shared Cookie Store, when the victims browse to the affected website via Mobile Safari, they will be logged into the attacker's account instead of their own.
Apple fixed the issue in iOS 9.2.1 by creating an isolated cookie store for all captive portals instead of relying on a shared store connected to Safari.
Skycure first reported its findings to Apple in June 2013, but notes the fix "was more complicated than one would imagine." There is no evidence to suggest the vulnerability was exploited outside of controlled experiments.
On Topic: iOS
- Apple issues iOS 9.3.5 update, patching serious security issues discovered just 10 days ago
- Apple to take on Snapchat, Facebook in 2017 with new iPhone video editing app - report
- Apple suggests five new professional emoji be added to Unicode Standard
- Siri's voice to benefit from machine learning improvements in Apple's iOS 10
- Retailers, payments association side with Australian banks over Apple Pay negotiations