December could very well be security month at Apple with the launch of , the , and now, the patching of a Bluetooth exploit that has been wreaking havoc for iPhone and iPad users since its discovery in September. Flipper Zero is no match for iOS 17.2 First pointed out by , can confirm that Apple has finally implemented safeguards in iOS 17.2 to prevent Flipper Zero devices from sending nearby and into never-ending denial of service (DoS) loops. Out of the box, Flipper Zero is a pretty harmless pen-testing tool. However, since the device is open source, it can be modified with new third-party firmware (in this case, ) that provides a Bluetooth Low-Energy (BLE) spam app. This took advantage of a BLE pairing sequence flaw that sent devices an overwhelming amount of Bluetooth connection notifications that caused them to freeze up and then reboot. A process that takes about 5 minutes to gain full functionality again. With a radio range of about 50 meters (~164 feet), threat actors have reportedly used malicious Flipper Zero devices to pull off DoS attacks on trains, coffee shops, and concert venues, far enough to remain undetected. What could iOS 17.2’s new safeguards be? When running a Flipper Zero against my own devices, I’ve found a few pesky popups still appear before completely stopping. This could point to a new send advertising packets, or ADV, request timeout Apple has implemented. To update your iPhone or iPad to iOS 17.2, head over to > tap > .
Leave a comment: