Team Pangu just discovered a new iOS vulnerability called ZipperDown. Here’s all you need to know about it.
Table of Contents
What is ZipperDown?
While analyzing App Store applications, Pangu Team came across a programming error that can have serious consequences. The team then decided to perform a large-scale analysis covering thousands of iOS apps.
This was achieved through their in-house application reverse engineering platform, Janus.
About 16,000 iPhone apps (10% of all App Store apps) were found to be vulnerable to this bug.
Though ZipperDown is more of an error, it can lead to overwriting of app’s data and remote code execution.
Surprisingly, popular apps that have millions of daily users are vulnerable to ZipperDown. Here’s a list of all affected applications –
- NetEase Music
- QQ Music
- MOMO
- Kwai
Pangu Team has confirmed that this bug also affects Android smartphones. However, the team has decided not to disclose its details yet.
How ZipperDown works
Here’s a video demonstration of this bug.
- User downloads and runs Weibo app.
- User connects to an unsafe WiFi network.
- Attacker hijacks user’s traffic.
- Code execution privileges in Weibo achieved.
ZipperDown vulnerability discovered by Team Pangu. #TeamPangu #security pic.twitter.com/J9mPnrgV3b
— Yalu Jailbreak (@Yalujb) May 19, 2018
How can you protect your device?
Since this error affects select applications, there’s no way to fix it unless the app developers release a patch.
But until that happens, you can keep using the app or remove it from your smartphone if you are feeling a bit too paranoid.
This vulnerability is restricted to affected apps thanks to the iOS sandbox.
This means even if an attacker mounts a successful attack, he will not be able to do much with your iPhone.
Pangu Team is yet to make the details of this vulnerability public. If you have an app that’s affected by this bug, be sure to contact the team at zipperdown(at)pwnzen.com.
For more security news and updates, follow us on Facebook and Twitter.
