Apple iPhone Or iPad Contacts App Could Be Leaking Your Private Data
Researchers from Check Point Software Technologies Ltd. have discovered a flaw in one of the most widely deployed pieces of software in the world, which also happens to be the backend for the contacts list on Apple devices like the iPhone and iPad. The software resource that Check Point found the flaw in is called SQLite, a database engine that is used in computer operating systems, desktops, mobile phones, and lots more. SQLite is used in Windows, MacOS, iOS, Google Chrome, and Android, among many others.
The fact that the SQLite database engine is so widely deployed has made it a rich target for would-be hackers. Hackers could exploit SQLite and gain administrative control of an iPhone, according to the researchers. The researchers developed a proof-of-concept allowing the team was able to gain greater access to iOS privileges by exploiting the database flaw. To exploit the SQLite flaw, the researchers used their techniques of digital query hijacking and programming to reliably exploit memory-corruption issues in the database engine.
The researchers say that if a hacker was successful in exploiting the flaw "the intruder owns your iPhone" and all the information on it. The team plans to show how an attacker could exploit the issue and bypass Apple's trusted secure boot mechanism to gain admin privileges on an iPhone at the DEF CON security conference in Las Vegas. Apple uses SQLite to store contacts on the iPhone and some saved passwords on Macs.
Check Point researchers did inform Apple of the issue in March and the company patched the flaw in May. The researchers have also notified Microsoft about the SQLite flaw. The team plans to outline the vulnerability in a 4,000-word report to be presented at the conference. Apple is reportedly considering giving dev iPhones to researchers to help them root out potential iOS security issues.
