Detecting and Defending Against Malicious Apple iOS WiFi Networks

Security researcher Carl Schou (@vm_call) recently disclosed a denial of service against Apple iOS devices that disables WiFi when connecting to a specific-formatted network name.

After joining my personal WiFi with the SSID “%p%s%s%s%s%n”, my iPhone permanently disabled it’s WiFi functionality. Neither rebooting nor changing SSID fixes it :~) pic.twitter.com/2eue90JFu3

— Carl Schou (@vm_call) June 18, 2021

The weakness appears to be within the way Apple iOS internally manages the use of the network name in messages. The formatting of the string causes an internal process to crash and, due to data persistence, it continuously loops and crashes, denying WiFi capabilities.

Thanks to LOCH’s AirShield and our 7×24 observability of all wireless things our customers are protected by being able to identify bad networks and any impacted clients. No other system can give you the depth of intelligence we can.

When detected, AirShield’s WiFi Termination feature will defend your environment until the malicious device can be physically identified and removed using our Mobile Incident Tracker application.

Should a device be affected by this denial of service attack, the only option is to reset its wireless settings. Do so by opening the Settings app, tap General -> Reset, then tap Reset Network Settings and confirm the request.

IoT has created the world’s largest attack surface — and 80% of IoT devices are wirelessly connected. Today’s networks and organizations were never built to handle the massive volume, velocity and hyper-connectivity of smart devices. Most businesses still struggle to identify IoT devices within their environment – creating new security blind spots.

AirShield℠ provides comprehensive visibility into the IoT and OT (operational technology) threat landscape in order to detect, assess and prevent risk from unmanaged, unsecured and misconfigured IoT devices.