Exploit-DB #28978
Description: Apple iOS 7.0.2 - Sim Lock Screen Display Bypass
Type: webapps
Platform: ios
Date: 2013-10-15
Author: Vulnerability-Lab

Exploit:
Document Title:
===============
Apple iOS 7.2 - Sim Lock Screen Display Bypass Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1105

Video: http://www.vulnerability-lab.com/get_content.php?id=1104


Release Date:
=============
2013-10-04


Vulnerability Laboratory ID (VL-ID):
====================================
1105


Common Vulnerability Scoring System:
====================================
6.1


Product & Service Introduction:
===============================
iOS (previously iPhone OS) is a mobile operating system developed and distributed by Apple Inc. Originally unveiled in 2007 
for the iPhone, it has been extended to support other Apple devices such as the iPod Touch (September 2007), iPad (January 2010), 
iPad Mini (November 2012) and second-generation Apple TV (September 2010). Unlike Microsoft`s Windows Phone and Google`s Android, 
Apple does not license iOS for installation on non-Apple hardware. As of August 2013, Apple`s App Store contained more than 900,000 
iOS applications, 375,000 of which were optimised for iPad. These apps have collectively been downloaded more than 50 billion times. 
It had a 21% share of the smartphone mobile operating system units shipped in the fourth quarter of 2012, behind only Google`s Android.
In June 2012, it accounted for 65% of mobile web data consumption (including use on both the iPod Touch and the iPad).[8] At the half 
of 2012, there were 410 million devices activated. According to the special media event held by Apple on September 12, 2012, 400 million 
devices had been sold by June 2012.

The user interface of iOS is based on the concept of direct manipulation, using multi-touch gestures. Interface control elements consist 
of sliders, switches, and buttons. Interaction with the OS includes gestures such as swipe, tap, pinch, and reverse pinch, all of which 
have specific definitions within the context of the iOS operating system and its multi-touch interface. Internal accelerometers are used 
by some applications to respond to shaking the device (one common result is the undo command) or rotating it in three dimensions (one 
common result is switching from portrait to landscape mode. iOS is derived from OS X, with which it shares the Darwin foundation and 
various application frameworks. iOS is Apple`s mobile version of the OS X operating system used on Apple computers.

Major versions of iOS are released annually. The current release, iOS 7, was released on September 18, 2013. In iOS, there are four 
abstraction layers: the Core OS layer, the Core Services layer, the Media layer, and the Cocoa Touch layer. The current version of the 
operating system (iOS 7.0.2), dedicates 1–1.5 GB of the device`s flash memory for the system partition, using roughly 800 MB of that 
partition (varying by model) for iOS itself.

(Copy of the Homepage: http://en.wikipedia.org/wiki/IOS )


Abstract Advisory Information:
==============================
The Vulnerability Laboratory Research Team discovered a local bypass vulnerability in the official Apple iOS v7.0.1 Mobile.


Vulnerability Disclosure Timeline:
==================================
2013-04-10:	Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Apple
Product: iOS 7.0.1

Apple
Product: iOS 7.0.2


Exploitation Technique:
=======================
Local


Severity Level:
===============
High


Technical Details & Description:
================================
A restricted screen bypass via design glitch is detected in the official Apple iOS v7.0.1 for Mobile Devices (iPad|iPhone).
The security vulnerability allows local attackers to bypass the display screen of the restricted sim locked mode.

The bypass vulnerability is located in the iOS v7.0.1/7.0.2 when the `sim locked` mode of an iphone mobile is activated.
Local attackers can redirect the sim locked display to the regular default mode by using a restricted calculator function in 
combination with the shutdown and unlock button. As result the local attacker is able to glitch > jump into the regular locked 
phone mode with calender + hyperlinks, camera and control center. The regular sim locked display is at the end usable like in 
the regular mode without sim locked label in the screen.

The local sim lock screen display bypass vulnerability can be exploited by local attackers with physical device access and without 
user interaction. Successful exploitation results in the bypass of the sim lock mode to the regular lock mode. In a earlier test (7.x) 
we combined the earlier discovered issues to first unlock the sim display (locked sim card) and bypass the pass code to fully compromise.


Proof of Concept (PoC):
=======================
The local vulnerability can be exploited by local attackers with physical device access and without user interaction.
For demonstration or reproduce ...

Manual reproduce like in the iphone poc security video ...

1.  Start your iPhone and ensure you have the iOS v7.0.1 installed
2.  Activate the Sim Lock mode
3.  Start the device new and you will see a black notification in the middle of the display (sim locked)
Note: Sometimes the message also comes up in the restricted mode with a grey message box in the middle of the display.
4.  Open the calender, and scroll down to the two hyper links
5.  Press the power button and wait 2 secounds in the last secound your press one of the two hyperlinks
6.  You get redirected via hyperlink because of the restriction to the pass code sim lock
7.  Press again 3 secound the power button and push at the end in the last secound the home button
8.  Click cancel again in the shutdown menu but hold the home button
9.  Open up the control center and go to the calculator. Now a message box appears automatically with the sim