Apple on Wednesday rolled out software updates for iOS and iPadOS to remediate a persistent denial-of-service (DoS) issue affecting the HomeKit smart home framework that could be potentially exploited to launch ransomware-like attacks targeting the devices.
The iPhone maker, in its release notes for iOS and iPadOS 15.2.1, termed it as a “resource exhaustion issue” that could be triggered when processing a maliciously crafted HomeKit accessory name, adding it addressed the bug with improved validation.
The so-called “doorLock” vulnerability, tracked as CVE-2022-22588, affects HomeKit, the software API for connecting smart home devices to iOS applications.
Should it be successfully exploited, iPhones and iPads can be sent into a crash spiral simply by changing the name of a HomeKit device to a string larger than 500,000 characters and tricking the target into accepting a malicious Home invitation.
Even worse, since HomeKit device names are backed up to iCloud, signing back into the affected iCloud account linked to the HomeKit device can re-trigger the DoS condition and cause the devices to enter an endless cycle of crash and reboot that can only be ended by restoring them to their factory settings.
Although the company attempted to mitigate the problem by introducing a limit on the length of the name an app or the user can set, it was found that it did nothing to prevent an attacker from running an earlier version that allows excessively long device names and then getting the victim to accept a rogue invitation via a phishing email.
The fix comes weeks after security researcher Trevor Spiniolas, who discovered the vulnerability, called out the company for failing to “take the matter seriously” despite having reported it in August 2021 and leaving its customers exposed to a pretty serious issue.
“Apple’s lack of transparency is not only frustrating to security researchers who often work for free, it poses a risk to the millions of people who use Apple products in their day-to-day lives by reducing Apple’s accountability on security matters,” Spiniolas said.
