Apple’s Operating Systems (OSs), especially the iOS is often regarded as the OS which is more secure than its competitors like Microsoft’s Windows, and Google’s Android, however, recently an independent cybersecurity researcher, Ryan Pickren had managed to recreate a vulnerability in the Apple’s iOS and macOS via Apple’s Safari web browser, which could have been used by hackers to maliciously attack and hack into the front camera of an iPhone. He found a massive flaw which could have resulted in a security breach.
Fortunately, for Apple, this vulnerability was discovered and disclosed to Apple, for which the tech giant awarded Pickren $75,000 in-line with the company’s bug bounty programme.
This vulnerability existed in both Webkit and Safari browser codes in the iOS which could have enabled the attackers to bypass iOS’ tight restrictions to access of the phone’s camera by a third-party process. In other words, Apple does not allow a random website or developer access to their device’s camera unless it is trusted or directly allowed by the user itself.
Having said this, a total of 7 vulnerabilities were detected in the Safari source code which could have allowed the attackers to trick the browser into thinking that a malicious website was truly a trusted video calling service such as Skype (which was demonstrated by the attacker).
All it would have taken an attacker, and as seen in Pickren’s proof of concept of this vulnerability, was to have convinced the user into clicking on the link which was malicious. After that, there was no other permission was needed from the user for the camera to be used.
Also Read: Schools In Noida Cannot Force Parents To Pay Fees Amid Lockdown
What was more alarming was that Pickren revealed that any JavaScript which is capable of creating a pop-up on any webpage could have created this breach, hence making it a serious threat that even a malicious code in otherwise a complete legitimate URL could have resulted in a breach have accessed the camera of the device even without the requirement of any authorisation from the user. The same flaw is said to affect the Safari on Mac as well.
Though it was not disclosed it the attacker(s) may have continued to have the access of the device’s camera post the closure of the Safari app and the background process for the application was ended. However, the flaw has now been patched by Apple and this patch was most likely a part of the regular and maintenance update for the users that they would have installed in recent times.
The full proof of this concept and the technical demonstration of this issue has been detailed in his blog by Pickren which can be read here: https://www.ryanpickren.com/webcam-hacking
