News: 1624312783

Joining a Wi-Fi network with a specific sequence of characters in its SSID name will break wireless connectivity for iOS devices. Thankfully the bug looks to be little more than an embarrassment and inconvenience.

On Friday, Carl Schou, a security researcher in Denmark, [1]reported that his iPhone lost its Wi-Fi capability after attempting to connect to a Wi-Fi network named "%p%s%s%s%s%n".

The offending name is made up of good old C language printf() -style [2]string format specifiers . On iOS, they are handled by Apple's open source [3]CFString framework, available to those writing Objective-C or Swift applications. CF stands for Core Foundation; CFString is a C API in macOS and iOS.

[4]

Security researcher Alex Skalozub told The Register that the disruptive series of characters can be shorter still. The string "%s%s%s" is sufficient to trigger the bug, he said, noting that it appears to be the third "%s" that takes down the Wi-Fi connection.

[5]

[6]

The "%s" tells the software to use a referenced string, which likely doesn't actually exist, causing the code to crash. Indeed, it appears to cause a strlen() function call to trigger a memory access fault. Apple's software should not be directly obeying these user-provided format strings as it's a [7]classic security vulnerability .

"Yesterday I showed how [an Access Point] named " [8]%Free %Coffee at %Starbucks " does the same thing," he said.

[9]

Fortunately, the damage appears not to be permanent. Apple iOS devices that lose Wi-Fi capability after being bitten by this bug can be restored via the General -> Reset -> Reset Network Settings menu option, which reverts network settings to their factory default.

Security flaw? Technically possible but...

Amichai Shulman, co-founder and CTO of enterprise network security firm AirEye, contends the bug could lead to remote code execution.

"While it is easy to use the vulnerability to simply disable the Wi-Fi capabilities of an attacked machine, the nature of format string vulnerabilities is that when carefully crafted they can be used to write arbitrary code into random, or chosen, parts of a machine’s memory – and even eventually inject and execute code," he wrote in a [10]blog post . "Since the device is on the corporate network, this code can eventually be used for lateral movement."

But absent any proof-of-concept exploit code, that remains a speculative assessment. Other security researchers don't see much to worry about.

[11]Latest phones are great at thwarting Wi-Fi tracking. Other devices, not so much – study

[12]Cisco’s 'intuitive security' tool can’t handle MAC address randomization out-of-the-box

[13]Microsoft pulls plug on IPv6-only Wi-Fi network over borked VPN fears

[14]Some Things just aren't meant to be (on Internet of Things networks). But we can work around that

The Wi-Fi failure, according to [15]a writeup by China-based security researcher Zhi Zhou (ChiChou), follows from a format string bug. He says he doesn't believe the bug is exploitable to achieve code execution.

Schou, who spotted the issue, similarly expressed doubt that the bug would be useful for further exploitation.

"This bug would be quite complicated to fully exploit, as you are limited by the length of the SSID and the functionality of the format string," he wrote in an email to The Register . "You could potentially turn this into an information disclosure, but to use it for anything remotely useful (besides crashing the Wi-Fi daemon) you would need another exploit."

[16]

Security researcher Alex Skalozub also dismissed the bug.

"I don’t believe it is exploitable," he told The Register in a message. "The CFString format string syntax doesn’t have %n format modifier, so writing into memory at the pointer on stack is impossible. Also the attacker doesn’t have control of the pointers on stack, because the format string is located on the heap."

As for remote code execution, Skalozub said that would only be possible using the %@ modifier, which prints a description of the Objective-C object. But that would require crafting a pointer to the appropriate object on the stack somehow, he said, which isn't likely for the reasons outlined above.

Apple did not respond to a request for comment. We haven't heard from anyone there in a while. We hope everyone in the company's uncommunicative communications group is okay.

Until this gets fixed (and even afterwards), you may want to steer clear of unusually named Wi-Fi networks. ®

Get our [17]Tech Resources



[1] https://twitter.com/vm_call/status/1405937492642123782?s=20

[2] https://developer.apple.com/library/archive/documentation/Cocoa/Conceptual/Strings/Articles/formatSpecifiers.html

[3] https://opensource.apple.com/source/CF/CF-368/String.subproj/CFString.c.auto.html

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YNFgXFvpv3lbYrYjqrst5gAAAMg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNFgXFvpv3lbYrYjqrst5gAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNFgXFvpv3lbYrYjqrst5gAAAMg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[7] https://owasp.org/www-community/attacks/Format_string_attack

[8] https://twitter.com/pieceofsummer/status/1406754153951645699?s=20

[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YNFgXFvpv3lbYrYjqrst5gAAAMg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[10] https://www.aireye.tech/post/the-apple-format-string-bug-from-a-silly-prank-to-an-airborne-attack

[11] https://www.theregister.com/2021/05/18/wifi_tracking_failures/

[12] https://www.theregister.com/2020/09/17/cisco_isemac_randomization_warning/

[13] https://www.theregister.com/2018/09/17/microsoft_mothballs_ipv6only_network/

[14] https://www.theregister.com/2018/07/25/iot_network_management_for_all/

[15] https://blog.chichou.me/2021/06/20/quick-analysis-wifid/

[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YNFgXFvpv3lbYrYjqrst5gAAAMg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[17] https://whitepapers.theregister.com/