The vulnerability of cookies that impersonate as an owner of an iOS terminal can be attacked, Apple is left for two and a half years

IOS latest version "IOS 10When Apple announces it in 2016ExpectedHowever, it became clear that Apple had neglected the vulnerability of iOS regarding Safari's cookie over two and half years.

Shared Cookie Stores Bug Fixed in iOS 9.2.1 »
https://www.skycure.com/blog/shared-cookie-stores-bug-fixed-in-ios-9-2-1/

IOS cookie theft bug allowed hackers to impersonate users | Ars Technica
http://arstechnica.com/security/2016/01/ios-cookie-theft-bug-allowed-hackers-to-impersonate-users/

Apple is up to dateIOS 9.2.1 Security Update"We fixed about vulnerabilities that can be accessed externally to cookies accumulated in Safari on iOS devices." This vulnerability has been found to be caused by the storage setting sharing cookies between in-app browser and Safari application used when connecting Wi-Fi network for the first time on iOS.

Generally, on the Wi-Fi connection screen, buttons such as "agree to the terms of use" and "certify" are prepared, so you can use Wi-Fi by tapping. According to Skycure's announcement by a security company, if you misuse this Wi-Fi connection screen, it means that all HTTP cookies stored on the terminal could be stolen from the outside.

ByKarlis Dambrans

Skycure researchers say that the following attacks were possible by exploiting the cookie's vulnerability.

· Steal HTTP cookies and impersonate users and access various sites
·Session fixed attackWhen users access various sites, they forcibly log in with the attacker's account instead of their own account
·DNS camouflage(Cache poisoning), every time a user connects to the Internet using Safari, malicious JavaScript charged by an attacker will be executed

In addition, Skycure researchers reported these issues to Apple in June 2013, but Apple finally made a fix in January 2015, about two and a half years later. In the latest version iOS 9.2.1, it is said that the storage location of the cookie used on the Wi-Fi connection screen is individually separated, and Skycure recommends iOS users to update the OS as soon as possible .