2

One exploit has caught my eye, mainly due to the possibility of malware incorporating it infecting businesses and schools. This exploit is, as you may have guessed from the title, the OSX/iOS Airdrop flaw, reported on here, which allows the writing of files to any destination without user intervention, so long as the target device's airdrop is turned on. This has been fixed in iOS 9, and, as most people update their phones regularly, will most likely not be a huge issue. However, in desktop and laptop space, people (and, especially, organizations) don't update their computers often, and may have versions of OSX as old as 10.7 or before. While I'm aware that the latest version of OSX has this vulnerability fixed, I'm interested in testing a batch of MacBooks (that are not updated regularly) to make sure they aren't vulnerable, and in patching them if they are. With this goal in mind, I looked up the exploit to see if I could find a test script, but all I could find was a plethora of news articles citing the vulnerability as yet another reason to upgrade to iOS 9. Some more descriptive articles told that Mark Dowd, of Azimuth Security, discovered the exploit and released a test video, but that's all I can find about the exploit. I can't find a CVE identifier for it, either. Did Dowd ever actually release the exploit details? It seems like I remember some malware or attacks using this, but I'm not sure. It's possible–albeit highly improbable–that this was a ruse meant to encourage people to update to iOS 9, but I doubt that. Anyway, it would be greatly appreciated if someone could shed some light on this exploit, its status, etc.

  • As an aside, the users of the macs I'm talking about are teens/young adults, and would most likely be capable of exploiting this bug. I found out about the bug while making the decision to enable airdrop on the laptops (preferable to flash drives in terms of productivity for file sharing, and preferable to dropbox in terms of ease of setup). – Saunders Eberly Apr 12 '16 at 15:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.