Security News iOS Trustjacking Attack Exposes iPhones to Remote Hacking (with no visible indicator to the device owner)

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/ios-trustjacking-attack-exposes-iphones-to-remote-hacking/

Symantec researchers have found a loophole in how iPhone users pair devices with Mac workstations and laptops. They say attackers can exploit this flaw —which they named Trustjacking— to take over devices without the phone owner's knowledge.

At the technical level, the Trustjacking security issue is rooted in the "iTunes Wi-Fi sync" feature included with iTunes.
If this option is enabled in the iTunes settings section, when a Mac laptop/workstation owner syncs a new iPhone to his computer, this feature allows him to connect at any time to the smartphone via the local WiFi network, instead of using a wired cable.
The feature is convenient, and for solid reasons, as it allows a PC owner to easily retrieve or send data from the smartphone via the iTunes app and its API.

....
....
....

But Symantec researchers say there's a flaw in the design of this feature, which continues to grant a computer owner access to a paired iPhone via the local WiFi network, even after the iPhone device has disconnected from the computer.

Attackers can take control of iPhones via local WiFi

Presenting their findings today at the RSA 2018 security conference, Roy Iarchy, Head of Research and Modern OS Security at Symantec, says an attacker can abuse the iTunes Wi-Fi sync feature to take control of a device at later times, with no visible indicator to the device owner.
... ... .....

Symantec says Trustjacking patch is not complete

Symantec says it notified Apple of the issue, but the solution Apple implemented to address the problem of Trustjacking attacks did not please its researchers.
The solution that Apple came up was to ask the iPhone user to enter the phone's passcode when pairing to a computer. This fix prevents random people from quickly grabbing your phone and pairing it to their own laptops.
... ... .... ...