4

The latest iOS update contains a fix for some zero day vulnerabilities involving core audio, where a maliciously crafted media file can cause harm.

I have received a file - how can I verify it does not contain this specific exploit? It is unclear which antivirus or malware detection software will even know about this exploit as it is recent. So is there some resource that specifically checks for this exploit?

Improve this question
6
  • 5
    "some zero day vulnerabilities" — please provide a reference to the specific vulnerabilities that you are asking about. Commented Apr 21 at 6:50
  • 1
    What you are looking for is called an "assurance", which isn't available here. Probably worth mentioning that iOS is a second class operating system platform, so any expectations of "assurance" or capability should be managed accordingly. If you are concerned about a device or data being compromised due to playing an audio file, you may want to consider using a different audio player. Commented Apr 21 at 8:19
  • 1
    "A resource that checks for exploits" is called anti-virus/malware. You are looking for a tool that is updated often and knows how to interpret media files for iOS exploits. Note that we are not the place to suggest any specific tools. Commented Apr 21 at 9:45
  • 2
    It's very unlikely any such tool will ever exist. First, the vulnerability may have been reported to Apple and never exploited in the wild; Second, even if exploited only a very limited number of people may have been involved, limiting the exposure; Third, EDRs are not a thing for iOS and at most a researcher may have written a dirt script to detect other weaponized files but nothing integrable in an EDR. The only option is to manually check for invalid fields in your file, eventually guided by patch diffing CoreAudio. But, unless you are a person of interest, you are not worth a 0-day. Commented Apr 21 at 9:53
  • 1
    This question has a bit of the same vibe as I see sometimes on StackOverflow: "is there code that does this without using a library?" while a library is something to share specific code. Wanting to eat pie without the pie. Commented Apr 22 at 12:04

2 Answers 2

Reset to default
5

An exploit will try to exploit a bug in your software. A “zero day” exploit is just a freshly detected exploit, where the attacker has a good chance that the bug is not fixed yet.

Since there is an OS update fixing the bug, just apply the update. If you get a file that would have exploited your computer before the update, it can’t do that anymore and you are safe. What will happen: For audio and picture files, most likely the OS will tell the application that this is not a valid file and will not allow the file to be played. The alternative is that at the point where the bug was exploited, the file is now actually valid. Or playing the file may crash the application in a way that cannot cause damage.

Unless you are specifically investigating malicious software/data, there is no need to know whether an exploit is present in the file. Otherwise, usually the exact details will not be published

PS Someone at apple with access to the source code containing the bug would have to take the file, play it, until it reaches the bug or not. Even if it reaches the bug, that doesn’t mean it’s an exploit. The bug might display one pixel worn under rare but legal circumstances, with a one in a billion chance of causing an exploit.

Improve this answer
4
  • 9
    "Unless you are specifically investigating malicious software/data, there is no need to know whether an exploit is present in the file." I strongly disagree. Imagine your new buddy sends you a file trying to hack you and it fails. Wouldn't you want to know?! Commented Apr 21 at 9:34
  • 4
    My guess is that the OP has not or doesn't want to update and is worried about the exposure Commented Apr 21 at 9:41
  • "most likely the OS will tell the application that this is not a valid file and will not allow the file to be played" Really? So the OS call to open the file will fail somehow with a specific error message because of the contents of the file? This is new to me; maybe there is an OS that does this, but I'm pretty sure that this is not universal. Commented Apr 22 at 10:58
  • No, on macOS or iOS a cAll “give me the data as an image” will fail. A file with an unfixed vulnerability may cause trouble. A file with a fixed vulnerability may produce an image if the vulnerability was handling some correct files wrong, or fail. Commented Apr 23 at 6:59
1

It is unclear which antivirus or malware detection software will even know about this exploit as it is recent.

This is software that is specifically meant for detecting such threats. It seems like that's precisely what you are asking for. So it seems to me that you should check the database of detected vulnerabilities of the specific tool to find out if the exploit is detected. You could then perform a manual scan of the file and check the log file.

For instance, you'd expect articles such as this one by Qualis. This will lead you to Qualis-specific ID named QID's that are used to indicate the detection method used. So if the scanner contains these fixes in the DB then you'd know it should perform an action if such a file is found.

Sometimes tools will be made available to the public to check for specific vulnerabilities. Often these tools were used by the original team to find the exploit or to prove that they were able to exploit the vulnerability - a proof-of-concept basically. This doesn't seem to be the case for this particular vulnerability though.

Given enough info you might also be able to detect such a file yourself of course. This would go beyond the skill of most users and of course effort that users are willing to spend. It also depends on the amount and quality of information available on the vulnerability. This information may not be released to the public to avoid hackers being to create an exploit too easily. In this case you would need know the field for which the bounds weren't checked, and to know how to parse the file to retrieve the offset of that field.

Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.