Black Hat Ethical Hacking
Apple fixes doorLock bug that can disable iPhones and iPads

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple fixes doorLock bug that can disable iPhones and iPadsPost Views: 93 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
Apple has released security updates to address a persistent denial of service (DoS) dubbed doorLock that would altogether disable iPhones and iPads running HomeKit on iOS 14.7 and later.
HomeKit is an Apple protocol and framework that allow iOS and iPadOS users to discover and control smart home appliances on their network.

As the company explained in a security advisory issued today, the doorLock vulnerability tracked as CVE-2022-22588 will crash affected iOS and iPadOS devices when processing maliciously crafted HomeKit accessory names.

Apple has addressed this severe resource exhaustion issue in iOS 15.2.1 and iPadOS 15.2.1 by adding improved input validation which no longer allows attackers to disable vulnerable devices.

Devices that received security updates today include iPhone 6s and later, iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).

“Four months ago I discovered and reported a serious denial of service bug in iOS that still remains in the latest release. It persists through reboots and can trigger after restores under certain conditions,” Trevor Spiniolas, the programmer and “beginning security researcher” who spotted and reported the bug.
See Also: Complete Offensive Security and Ethical Hacking Course “All the requirements are default settings. When someone sets up their iOS device, everything is already in order for the bug to work. If they accept a malicious home invitation from there, their device stops working.”
See Also: Microsoft: New critical Windows HTTP vulnerability is wormable Fix delayed since AugustAccording to Spiniolas, Apple has known about doorLock since August 2021, 2021, but pushed the security update multiple times despite repeatedly promising to fix it.

“I believe this bug is being handled inappropriately as it poses a serious risk to users and many months have passed without a comprehensive fix,” Spinolas said.

“The public should be aware of this vulnerability and how to prevent it from being exploited, rather than being kept in the dark.”

The researcher says attackers would have to change the name of a HomeKit device to large strings of up to 500,000 characters and trick the target into accepting a Home invitation.

Once the target joins the attacker’s HomeKit network, their device becomes unresponsive and eventually crashes.

The only way to recover from such an attack would be to factory reset the disabled device, given that it will once again crash after restarting and signing back into the iCloud account linked to the HomeKit device.
See Also: Offensive Security Tool: Osmedeus Zero-day patches also delayedIn September, software developer Denis Tokarev also dropped proof-of-concept exploit code for three iOS zero-day flaws on GitHub after Apple delayed patching and failed to credit him when patching a fourth in July.

One month later, with the release of iOS 15.0.2, Apple fixed one of the ‘gamed’ zero-day vulnerabilities reported by Tokarev.

However, Apple didn’t acknowledge or credit him for the discovery and also asked him to keep quiet and not disclose to others that the company failed to give him credit for the bug.

Other security researchers and bug bounty hunters have also gone through similar experiences saying th[...]

___________________________
@hacking_Attack
@Hacking_Video

at they have been kept in the dark for months on end with Apple refusing to reply to their messages.
See Also: Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0_Windows-headpic-90x90.jpg Microsoft: New critical Windows HTTP vulnerability is wormable1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/powerdir-exploit-microsoft-90x90.jpg Microsoft: powerdir bug gives access to protected macOS user data2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/using-npm-create-javascript-icon-libraries-90x90.png Dev corrupts NPM libs ‘colors’ and ‘faker’ breaking thousands of apps3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-7-90x90.jpg Partially Unpatched VMware Bug Opens Door to Hypervisor Takeover6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-iPhone-13-Pro-90x90.png iOS malware can fake iPhone shut downs to snoop on camera, microphone7 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/0358ad020c37-article-cache-poisoning-article-90x90.png Researcher discovers 70 web cache poisoning vulnerabilities, nets $40k in bug bounty rewards1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/1200x0-90x90.jpg Apple iOS vulnerable to HomeKit ‘doorLock’ denial of service bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/exchange-90x90.png Microsoft releases emergency fix for Exchange – 2022 bug1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/maxresdefault-90x90.jpg Have I Been Pwned adds 441K accounts stolen by RedLine malware2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/1229111902.0-90x90.jpg T-Mobile says new data breach caused by SIM swap attacks2 weeks ago
The post Apple fixes doorLock bug that can disable iPhones and iPads first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Getting into a locked iphone

Hello there im a long time lurker of this subreddit and recently my mother asked me about if i can get into a locked iphone, it belongs to one of her students sister who passed away under unfortunate circumstances, so her family really wants to see her last messages and such. I adviced them to go to apple support to see if they can help since i think they might be the ones with the best shot at extracting the messages. Otherwise i was thinking if you could backup the files using a pc with apples backup files feature and then add those to my old iphone and through that to be able to access the messages.

submitted by /u/That_bakedpotato
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
At the beginning of the new year, Impresa, Portugal’s largest broadcaster TV and newspaper, was…

The attack affected the media giant Impresa’s main websites, which remained offline early Tuesday. It is reported that the server…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Soldi contraffatti non rilevabili in vendita online whatsapp economici: +45 71 50 60 70.

https://cdn-images-1.medium.com/max/1080/1*bOkIYpWuINVj4OBYLuwD0A.jpeg
Vuoi acquistare denaro falso di qualità, patente, esami EITLS, contattaci whatsapp: +45 71 50 60 70

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes
http://www.kitploit.com/2022/01/scemu-x86-32bits-emulator-for-securely.html

___________________________
@hacking_Attack
@Hacking_Video

x86 32bits emulator, for securely emulating shellcodes.
Features  rust safety, good for malware. All dependencies are in rust. zero unsafe{} blocks. very fast emulation (https://www.kitploit.com/search/label/Emulation) (much faster than unicorn) 3,000,000 instructions/second 100,000 instructions/second printing every instruction -vv. powered by iced-x86 rust dissasembler awesome library. iteration detector. memory and register tracking. colorized. stop at specific moment and explore the state or modify it. 105 instructions implemented. 112 winapi implemented of 5 dlls. all linux syscalls. SEH chains. vectored exception handler. PEB, TEB structures. memory allocator. react with int3. non debugged cpuid. tests with known payloads: metasploit shellcodes. metasploit encoders. cobalt strike. shellgen. guloader (not totally for now, but arrive further than the debugger) TODO - more fpu
- mmx
- 64 bits
- scripting?
Usage emulator for Shellcodes (https://www.kitploit.com/search/label/Shellcodes) 0.2.5 @sha0coder USAGE: scemu [FLAGS] [OPTIONS] FLAGS: -e, --endpoint perform communications with the endpoint, use tor or vpn! -h, --help Prints help information -l, --loops show loop interations, it is slow. -m, --memory trace all the memory accesses read and write. -n, --nocolors print without colors for redirectin to a file >out -r, --regs print the register values in every step. -V, --version Prints version information -v, --verbose -vv for view the assembly, -v only messages, without verbose only see the api calls and goes faster OPTIONS: -b, --base set base address for code -c, --console select in which moment will spawn the console (https://www.kitploit.com/search/label/Console) to inspect. -C, --console_addr spawn console on first eip = address -a, --entry entry point of the shellcode, by default starts from the beginning. -f, --filename set the shellcode binary file. -i, --inspect monitor memory like: -i 'dword ptr [ebp + 0x24] -M, --maps select the memory maps folder -R, --reg trace a specific register in every step, value and content -s, --string monitor string on a specific address">SCEMU 32bits emulator for Shellcodes 0.2.5
@sha0coder

USAGE:
scemu [FLAGS] [OPTIONS]

FLAGS:
-e, --endpoint perform communications with the endpoint, use tor or vpn!
-h, --help Prints help information
-l, --loops show loop interations, it is slow.
-m, --memory trace all the memory accesses read and write.
-n, --nocolors print without colors for redirectin to a file >out
-r, --regs print the register values in every step.
-V, --version Prints version information
-v, --verbose -vv for view the assembly, -v only messages, without verbose only see the api calls and goes
faster

OPTIONS:
-b, --base set base address for code
-c, --console select in which moment will spawn the console to inspect.
-C, --console_addr spawn console on first eip = address
-a, --entry entry point of the shellcode, by default starts from the beginning.
-f, --filename set the shellcode binary file.
-i, --inspect monitor memory like: -i 'dword ptr [ebp + 0x24]
-M, --maps select the memory maps folder
-R, --reg trace a specific register in every step, value and content
-s, --string monitor string on a specific address
Some use cases scemu emulates a simple shellcode detecting the execve() interrupt.

___________________________
@hacking_Attack
@Hacking_Video

We select the line to stop and inspect the memory.

___________________________
@hacking_Attack
@Hacking_Video

After emulating near 2 million instructions of GuLoader win32 in linux, faking cpuid's and other tricks in the way, arrives to a sigtrap to confuse debuggers.

___________________________
@hacking_Attack
@Hacking_Video

Example of memory dump on the api loader.

___________________________
@hacking_Attack
@Hacking_Video

There are several maps by default, and can be created more with apis like LoadLibraryA or manually from the console.

___________________________
@hacking_Attack
@Hacking_Video

Emulating basic windows shellcode based on LdrLoadDLl() that prints a message:

___________________________
@hacking_Attack
@Hacking_Video

The console allow to view an edit the current state of the cpu: h --- help --- q ...................... quit cls .................... clear screen h ...................... help s ...................... stack v ...................... vars r ...................... register show all r reg .................. show reg rc ..................... register change f ...................... show all flags fc ..................... clear all flags fz ..................... toggle flag zero fs ..................... toggle flag sign c ...................... continue ba ..................... breakpoint on address bi ..................... breakpoint on instruction number bmr .................... breakpoint on read memory bmw .................... breakpoint on write memory bc ..................... clear breakpoint n ...................... next instruction eip .................... change eip push ................... push dword to the stack pop .................... pop dword from stack fpu .................... fpu view md5 .................... check the md5 of a memory map seh .................... view SEH veh .................... view vectored execption pointer m ...................... memory maps ma ..................... memory allocs mc ..................... memory create map mn ..................... memory name of an address ml ..................... memory load file content to map mr ..................... memory read, speficy ie: dword ptr [esi] mw ..................... memory read, speficy ie: dword ptr [esi] and then: 1af md ..................... memory dump mrd .................... memory read dwords mds .................... memory dump string mdw .................... memory dump wide string mdd .................... memory dump to disk mt ..................... memory test ss ..................... search string sb ..................... search bytes sba .................... search bytes in all the maps ssa .................... search string in all the maps ll ..................... linked list walk d ...................... dissasemble dt ..................... dump structure enter .................. step into">--- console ---
=>h
--- help ---
q ...................... quit
cls .................... clear screen
h ...................... help
s ...................... stack
v ...................... vars
r ...................... register show all
r reg .................. show reg
rc ..................... register change
f ...................... show all flags
fc ..................... clear all flags
fz ..................... toggle flag zero
fs ..................... toggle flag sign
c ...................... continue
ba ..................... breakpoint on address
bi ..................... breakpoint on instruction number
bmr .................... breakpoint on read memory
bmw .................... breakpoint on write memory
bc ..................... clear breakpoint
n ...................... next instruction
eip .................... change eip
push .............. ..... push dword to the stack
pop .................... pop dword from stack
fpu .................... fpu view
md5 .................... check the md5 of a memory map
seh .................... view SEH
veh .................... view vectored execption pointer
m ...................... memory maps
ma ..................... memory allocs
mc ..................... memory create map
mn ..................... memory name of an address
ml ..................... memory load file content to map
mr ..................... memory read, speficy ie: dword ptr [esi]
mw ..................... memory read, speficy ie: dword ptr [esi] and then: 1af
md ..................... memory dump
mrd .................... memory read dwords
mds .................... memory dump string
mdw .................... memory dump wide string
mdd .................... memory dump to disk
mt ..................... memory test
ss ..................... search str ing

___________________________
@hacking_Attack
@Hacking_Video