iOS 15.2.1 Released: Apple Patches HomeKit Flaw for iPhones & iPads

Apple Addresses Critical HomeKit Security Flaw

A significant security vulnerability affecting iOS and iPadOS has been resolved by Apple. This flaw could potentially enable malicious actors to initiate sustained denial-of-service (DoS) attacks.

Details of the “doorLock” Vulnerability

iOS 15.2.1 and iPadOS 15.2.1 were released by the tech company on Wednesday to address the “doorLock” vulnerability. This issue was initially brought to light earlier this month by security researcher Trevor Spiniolas.

The vulnerability impacts iPhones and iPads operating on iOS versions from 14.7 through 15.2. It is triggered through HomeKit, Apple’s platform for managing and controlling smart home devices.

How the Attack Works

Exploitation requires an attacker to modify the name of a HomeKit device to a string exceeding 500,000 characters. Loading this excessively long string on a user’s device causes it to enter a denial-of-service state.

A forced restart is then necessary to restore functionality. However, upon rebooting and re-entering iCloud credentials associated with HomeKit, the vulnerability is re-activated.

Potential for Phishing and Ransomware

Even users without existing HomeKit devices are at risk. Attackers could establish a fraudulent Home network and lure users into connecting through phishing emails.

Furthermore, Spiniolas cautioned that the “doorLock” vulnerability could be exploited for ransomware attacks. Devices could be rendered unusable, with attackers demanding payment to revert the HomeKit device name to a safe length.

Delayed Response and Researcher Concerns

Apple initially committed to addressing the issue in a security update last year. However, the fix was postponed until “early 2022.” This delay prompted Spiniolas to publicly disclose the vulnerability, citing a “serious risk” to users.

Spiniolas expressed frustration with Apple’s communication regarding the issue. He noted infrequent updates and a lack of detailed information despite repeated requests.

He also highlighted that Apple’s limited transparency not only discourages security researchers but also diminishes accountability for security matters, potentially endangering millions of users.

Update Availability

The update is now available for download and supports the following devices:

• iPhone 6s and later
• All iPad Pro models
• iPad Air 2 and later
• iPad 5th generation and later
• iPad mini 4 and later
• iPod touch (7th generation)