Skip to main content

Apple iOS Trustjacking Vulnerability

A new vulnerability has been discovered with iOS devices which lets you exploit the “WiFi Sync” feature allowing a malicious user unauthorised access to a device wirelessly.

Threat ID:
CC-2292
Category:
Threat Severity:
Low
Threat Vector:
Published:
26 April 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A new vulnerability has been discovered with iOS devices which lets you exploit the “WiFi Sync” feature allowing a malicious user unauthorised access to a device wirelessly.

Affected platforms

The following platforms are known to be affected:

iOS

iOS Devices- versions 10 or previous

Threat details

WiFi Sync Is a feature on iOS that lets you manage your devices from your computer without connecting them. If this feature is enabled and you connect to a new device, it may ask you whether you trust the device. If this is allowed it can give unauthorised access to the device even when the device is disconnected from the computer or charger it was connected to.

This can let malicious users remotely view the device screen, install malicious apps and steal things like Photos, Message history and App data.

Remediation steps

Type Step
  • This vulnerability has been patched in iOS 11. Update to the most recent version of iOS.
  • Users are advised clean the trusted computers list by going to Settings > General > Reset > Reset Location & Privacy, you will need to reauthenticate your trusted devices after doing this.
  • Ensure that strong password policies are in place and password reuse is discouraged.

Last edited: 19 January 2022 1:58 pm