Connect with us

Hi, what are you looking for?

HEADLINES

‘Darwin Nuke’ vulnerability exposes Apple devices to DDoS attacks

iPhone 5 with iOS 7

Kaspersky Lab security researchers have discovered a vulnerability in the kernel of Darwin – an open-source component of both the OS X and iOS operating systems.

This “Darwin Nuke” vulnerability leaves OS X 10.10 and iOS 8 devices exposed to remotely-activated denial of service (DoS) attacks that can damage the user’s device and impact any corporate network to which it is connected. The experts call on users to update devices with the OS X 10.10.3 and iOS 8.3 software releases, which no longer include this vulnerability.

Analysis of the vulnerability by Kaspersky Lab revealed that the devices affected by the threat include those with 64-bit processors and iOS 8: iPhone 5s, iPhone 6, iPhone 6 Plus, iPad Air, iPad Air 2, iPad mini 2, and iPad mini 3.

The “Darwin Nuke” vulnerability is exploited while processing an IP packet of specific size and with invalid IP options. Remote attackers can initiate a DoS (denial of service) attack on a device with OS X 10.10 or iOS 8, sending an incorrect network packet to the target.

Advertisement. Scroll to continue reading.

After processing the invalid network packet, the system will crash. Kaspersky Lab’s researchers discovered that the system will crash only if the IP packet meets the following conditions:

–  The size of the IP header should be 60 bytes.
–  The size of the IP payload should be less than or equal to 65 bytes.
–  The IP options should be incorrect (invalid option size, class, etc.)

“At first sight, it is very hard to exploit this bug, as the conditions attackers need to meet are not trivial ones. But persistent cybercriminals can do so, breaking down devices or even affecting the activity of corporate networks. Routers and firewalls would usually drop incorrect packets with invalid option sizes, but we discovered several combinations of incorrect IP options that are able to pass through the Internet routers. We’d like to warn all OS X 10.10 and iOS 8 users to update devices to OS X 10.10.3 and iOS 8.3 releases,” – says Anton Ivanov, Senior Malware Analyst at Kaspersky Lab.

Kaspersky Lab says its products protect OS X against the “Darwin Nuke” vulnerability with the Network Attack Blocker feature. Starting with Kaspersky Internet Security for Mac 15.0, this threat is detected as DoS.OSX.Yosemite.ICMP.Error.exploit.

Kaspersky Lab’s tips for boosting the security of Mac devices include:

Advertisement. Scroll to continue reading.

1. Use a web browser that has a solid track record of fixing security issues promptly.

2. Run “Software Update” and patch the machine promptly when updates are available.

3. Use a password manager to help cope with phishing attacks.

4. Install a good security solution.

Advertisement. Scroll to continue reading.
Advertisement
Advertisement
Advertisement

Like Us On Facebook

You May Also Like

HEADLINES

For the first time ever last year, companies across the world rushed to pivot online as the pandemic spread across the world. In a...

HEADLINES

Among messenger services, users are most concerned with the WhatsApp security level - the share of requests about its security policy was 13.9%.

Headlines

The multibillion-peso investment has enabled the two companies to block 3,020 domains that host illicit materials featuring children as mandated by the National Telecommunications...

HEADLINES

Kaspersky researchers have discovered that the Russian-speaking threat actor Turla has revamped its toolset — wrapping its famous JavaScript KopiLuwak malware in a new...

HEADLINES

Cyber security solutions provider Kaspersky detected 31-million online threats in the Philippines from January to December last year, of which 82.46% were directed from...

HEADLINES

The global cybersecurity company’s enterprise service has risen to the top as it earns this year’s Cybersecurity for IT Services award.

HEADLINES

The problem of proper access to work assets is also highlighted by the fact that just under a third (29%) of workers admit to...

OPINIONS

Organizations that outsource IR can establish the processes faster, as an external IR team is always on hand to step in and resolve an...

Advertisement