After constant publicity from all parties and various virus threats, users finally understood that there is no truly secure system in the world, even the iPhone with a closed system. The increasing number of viruses targeting iOS confirms the innovation of unscrupulous people. Recently, a virus named “NoReboot” invaded your real privacy in a relatively new way.
NoReboot virus pretends iPhone is shut down to hijack user’s microphone and camera
The NoReboot virus, discovered by security research unit ZecOps, covers the operation of malware by simulating a phone shutdown. This may include hijacking the phone’s microphone and camera to monitor the phone holder’s daily life. Under the control of viruses, users generally cannot feel the difference between true shutdown and false shutdown. No user interface or buttons or responses will be displayed until you “restart” the phone.
The normal shutdown of a mobile phone will mainly link three programs: InCallService, SpringBoard and backboardd to display all behaviors during shutdown. When the iPhone is powered off, there will be physical indicators that the operation has been completed, such as a ring or sound, vibration, and an Apple logo appearing on the screen. However, by disabling physical feedback, malware can appear to be powered off while maintaining a real-time connection to the remote end.
The researchers explain that when you slide the power off icon. It is actually an application named /Applications/InCallService.app that sends a shutdown signal to SpringBoard, the program responsible for most UI interactions. An unscrupulous person hijacked the signal so that instead of sending a shutdown signal to SpringBoard, it notified SpringBoard and backboard to trigger the injected code. Then, the spinning circles that indicate the shutdown process can be hijacked via the backboard, and the SpringBoard functionality can force quit and prevent another restart. ZecOps says that by taking over SpringBoard, the target iPhone can “look” and “feel” like it’s not turned on, which is the perfect disguise to simulate a fake shutdown.
You may be thinking, then I can just restart it! This is where malicious virus tampering with the backboard further comes into play. By monitoring user input, including how long a button is held down, it is possible to simulate a reboot before it actually reboots, for example by displaying the Apple logo in advance to prevent the user from rebooting an infected phone.
Because the technique focuses on deceiving users rather than exploiting vulnerabilities or bugs in the iOS platform, it cannot be fixed through any updates. ZecOps said that NoReboot’s intrusion method affects all versions of iOS, and only hardware detection can help detect this form of attack technique.
Source: KOCPC Chinese