iPhone users should beware after a bug is disclosed that can disable the WiFi system simply by connecting to a hotspot with a specially crafted name.
The bug in iOS results from a poorly sanitised input string (Improper Input Validation) and in this case it was a failure to remove escape sequences from the input.
Any iPhone that joins a WiFi network with the name “%p%s%s%s%s%n” would enter a loop that prevented the WiFi subsystem from starting or joining a different WiFi network. A user who is tricked into joining a WiFi hotspot with this malicious SSID would then be unable to connect to any WiFi network until they reset the device’s network settings.
From a security perspective, the risk appears to be limited to a device specific denial of service but could be used to cause a distraction during some form of wider attack.
The nefarious WiFi connection can only be removed by resetting the iPhone’s network settings: Settings > General > Reset > Reset network Settings.
The need to sanitise and validate user input is well understood for web applications, featuring regularly in the OWASP Top 10 where it can lead to Injection attacks and Cross Site Scripting attacks. However, this iOS flaw is a reminder that desktop, mobile and even operating system software also needs to implement secure coding practices to defend against malicious input.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)