You’ve Got (0-click) Mail! Impact & Key Details (TL;DR)

Jedi · 2020-04-22T22:20:33+00:00

The vulnerability allows remote code execution capabilities and enables an attacker to remotely infect a device by sending emails that consume significant amount of memory The vulnerability does not necessarily require a large email – a regular email which is able to consume enough RAM would be sufficient. There are many ways to achieve such resource exhaustion including RTF, multi-part, and other methods Both vulnerabilities were triggered in-the-wild The vulnerability can be triggered before the entire email is downloaded, hence the email content won’t necessarily remain on the device We are not dismissing the possibility that attackers may have deleted remaining emails following a successful attack Vulnerability trigger on iOS 13: Unassisted (/zero-click) attacks on iOS 13 when Mail application is opened in the background Vulnerability trigger on iOS 12: The attack requires a click on the email. The attack will be triggered before rendering the content. The user won’t notice anything anomalous in the email itself Unassisted attacks on iOS 12 can be triggered (aka zero click) if the attacker controls the mail server The vulnerabilities exist at least since iOS 6 – (issue date: September 2012) – when iPhone 5 was released The earliest triggers we have observed in the wild were on iOS 11.2.2 in January 2018

Jedi

Well-known member

Member

Apr 22, 2020

The vulnerability allows remote code execution capabilities and enables an attacker to remotely infect a device by sending emails that consume significant amount of memory
The vulnerability does not necessarily require a large email – a regular email which is able to consume enough RAM would be sufficient. There are many ways to achieve such resource exhaustion including RTF, multi-part, and other methods
Both vulnerabilities were triggered in-the-wild
The vulnerability can be triggered before the entire email is downloaded, hence the email content won’t necessarily remain on the device
We are not dismissing the possibility that attackers may have deleted remaining emails following a successful attack
Vulnerability trigger on iOS 13: Unassisted (/zero-click) attacks on iOS 13 when Mail application is opened in the background
Vulnerability trigger on iOS 12: The attack requires a click on the email. The attack will be triggered before rendering the content. The user won’t notice anything anomalous in the email itself
Unassisted attacks on iOS 12 can be triggered (aka zero click) if the attacker controls the mail server
The vulnerabilities exist at least since iOS 6 – (issue date: September 2012) – when iPhone 5 was released
The earliest triggers we have observed in the wild were on iOS 11.2.2 in January 2018