Researcher Discovers Shocking Zero-Click iOS Remote WiFi Exploit

A Google Project Zero researcher has discovered an iOS exploit that allows a threat actor to remotely take over an individual’s iPhone.

Google Project Zero white-hat hacker Ian Beer on Tuesday disclosed details of a now-patched critical “wormable” iOS bug that could have made it possible for a remote attacker to gain complete control of any device in the vicinity over Wi-Fi.

With such remote control, the exploit allowed bad actors to read messages, view images — essentially, monitor everything taking place — as long as the device was in relatively close proximity.

The exploit makes it possible to “view all the photos, read all the email, copy all the private messages and monitor everything which happens on [the device] in real-time,” said Beer in a lengthy blog post detailing his six-month-long efforts into building a proof-of-concept single-handedly.

Beer was able to develop a technique to send an exploit via WiFi that requires no user interaction at all, and doesn’t even need the target to be connected to the internet. In other words, if an iPhone was in range of someone with this capability, they could take it over without requiring you to click on a link or anything of the like.

Shockingly, Beer’s exploit could have been made into a worm, meaning it could propagate to nearby iPhones automatically, spreading exponentially.

Although there’s no evidence that the vulnerability was exploited in the wild, the researcher noted that “exploit vendors seemed to take notice of these fixes.”