Apple rapidly squashes iOS 11.2 HomeKit bug

The bug allowed unauthorised access to smart locks and other devices

A HomeKit vulnerability was found in the current version of iOS 11.2 that gave unauthorised access to connected smart devices like smart locks and garage door openers.

The vulnerability was demonstrated to 9to5Mac which kept its detail under wraps in order to prevent oportunistic hackers from exploting the security hole.

Advertisement - Article continues below

The report stressed that the issue was not with the accessories themselves but with the HomeKit framework as a whole which connects smart products from different companies.

It allowed third-party remote control of these HomeKit connected accessories, such as lights and thermostats as well as the more serious devices like locks and door openers, posing a potentially serious security problem.

The bug affected those with at least one device on the iOS 11.2 connected to a HomeKit user's iCloud account, while those with earlier operating systems were not affected.

Users who were affected don't need to take any action to secure their devices as Apple has already implemented a server side update, which has fixed the problem. However, the fix does disable some of the HomeKit functionality for remote users, although the disruption to the service's functionality will be fixed in the future iOS update.

"The rush to make every home device smart turns out to be a stupid decision as we learn about more and more vulnerabilities in IoT devices. As it stands right now, there's no liability for companies building insecure devices so we'll continue to see the market flooded with cheap "smart" devices. Owners need to be vigilant in monitoring for device updates if they choose to deploy these in their own homes," senior security researcher at Cylance, Jeff Tang, told IT Pro.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

Such a security hole demonstrates how the spread of more smart and connected devices in the consumer and business technology world, thanks to the continued growth of the internet of things (IoT), can inject more potential cyber attack vectors into home and office networks.

As such, there is more work that needs to be done to mitigate these risks and establish standards of cyber security in the IoT world before it grows out of control.

Picture courtesy of Apple

Featured Resources

Successful digital transformations are future ready - now

Research findings identify key ingredients to complete your transformation journey

Download now

Cyber security for accountants

3 ways to protect yourself and your clients online

Download now

The future of database administrators in the era of the autonomous database

Autonomous databases are here. So who needs database administrators anymore?

Download now

The IT expert’s guide to AI and content management

Your guide to the biggest opportunities for IT teams when it comes to AI and content management

Download now
Advertisement

Recommended

Visit/security/vulnerability/355276/businesses-brace-for-second-fujiwhara-effect-of-2020-as-patch-tuesday
vulnerability

Businesses brace for second 'Fujiwhara effect' of 2020 as Patch Tuesday looms

9 Apr 2020
Visit/security/cyber-security/355267/zoom-hires-ex-facebook-cso-to-boost-platform-security
cyber security

Zoom hires ex-Facebook CSO Alex Stamos to boost platform security

8 Apr 2020
Visit/security/privacy/355241/privacy-of-apples-coronavirus-screening-app-comes-under-fire
privacy

Apple's coronavirus screening app comes under fire over privacy concerns

6 Apr 2020
Visit/security/vulnerability/355236/hp-support-assistant-flaws-leave-windows-devices-open-to-attack
vulnerability

HP Support Assistant flaws leave Windows devices open to attack

6 Apr 2020

Most Popular

Visit/mobile/mobile-phones/355239/microsofts-patent-design-reveals-a-mobile-device-with-a-third-screen
Mobile Phones

Microsoft patents a mobile device with a third screen

6 Apr 2020
Visit/software/video-conferencing/355257/taiwan-first-country-to-ban-zoom-amid-security-concerns
video conferencing

Taiwan becomes first country to ban Zoom amid security concerns

8 Apr 2020
Visit/security/cyber-security/355271/microsoft-gobbles-up-corpcom-domain-to-keep-it-from-hackers
cyber security

Microsoft gobbles up corp.com domain to keep it from hackers

8 Apr 2020