Intrepidus Group Security Advisory
http://www.intrepidusgroup.com
Title: Apple TV Touch Setup Wi-Fi and iTunes Password Disclosure
Release Date: 10 March 2014
Discoverer: David Schuetz <david.schuetz@intrepidusgroup.com>
Vendor: Apple
Vendor Reference: http://support.apple.com/kb/HT1222
CVE Reference: CVE-2014-1279
Systems Affected: Apple TV (3rd generation) running ATV 6.0 - 6.0.2
Risk: Medium
Status: Published
Timeline
- Discovered: 10 October 2013
- Reported: 8 November 2013
- Fixed: 10 March 2014
- Published: 10 March 2014
Summary
The release of Apple TV version 6.0, based on iOS 7.0, introduced a new convenience feature for the setup of new Apple TV units, colloquially referred to as “Touch Setup.”
This features permits a user with a mobile iOS device such as an iPhone, to use BlueTooth Low Energy (BTLE) to transfer certain configuration information to a newly-activated Apple TV system, including iTunes Store ID and password, and Wi-Fi SSID and password.
An issue exists where detailed logging is enabled in the Apple TV.app binary, resulting in detailed packet data being dumped to the Apple TV log. This data includes hexadecimal representations of the configuration information transferred from the mobile device to the Apple TV, including AppleID and Wi-Fi passwords passed in cleartext.
An attacker with access to an Apple TV may be able to recover this data from the system log, if it has been stored on the Apple TV.
Details
Apple TV applications may save certain logging and debugging information to the system using NSLog() and similar mechanisms. The logs may be viewed by attaching the Apple TV unit to an OS X system via a micro-USB cable, and using an application such as the Xcode Organizer or iPhone Configuration Utility.
In general, these log entries are ephemeral, however, certain log data on the Apple TV (and other iOS devices in general) are retained to some degree on the device filesystem and may thus be available for viewing at a later date. At this time, it is not clear whether the Touch Setup logs are retained on the Apple TV or mobile iOS device after completion of the setup process.
The Apple TV app (as well as the touchsetupd daemon on the mobile iOS device) sends detailed descriptions of data sent and received during the Touch Setup process.
In the case of the mobile iOS device, this data is encrypted using a key exchanged between the two devices. However, it may be possible that enough information is leaked in these debug messages (or other related log entries) that an attacker may recover the session key and thus decrypt the entire conversation.
In the case of the Apple TV unit, the data are generally written to the log two or even three times: First, the raw encrypted data as received from the mobile device, then the decrypted, yet compressed, plaintext of that data, and then finally the uncompressed data itself.
The decompressed data containing configuration information required to complete the Touch Setup process is provided as a binary property list (plist). The plist contains, among other data, the following information:
AppleID (iTunes account) information:
- First Name
- Last Name
- AppleID (email address)
- Password
Local Wi-Fi information:
- SSID
- Password
Steps to Reproduce
To demonstrate this vulnerability, the following hardware will be required:
- Apple TV (3rd generation) running Apple TV system version 6.0 through 6.0.2
- A “recent” mobile iOS device such as iPhone 4S or later (see Systems Affected for full list), running iOS version 7.0 or later
- A system running OS X, with Xcode installed
- A display connected to the Apple TV via HDMI
- A micro-USB cable connected to the Apple TV and ready to connect to a system running OS X
The procedure is as follows:
-
Ensure the Apple TV is “factory fresh” either by acquiring a new, shrink-wrapped unit, or using a full “factory reset” on an existing unit.
-
Connect the Apple TV to the display using HDMI
-
Connect the micro-USB cable to the Apple TV (it may be necessary to obtain a very low-profile connector, or to use a utility knife to shave the micro-USB connector, in order to connect both the HDMI and USB connectors simultaneously). DO NOT connect the cable to the OS X machine at this point.
-
Ensure the mobile iOS device has BlueTooth enabled and is logged in to the local Wi-Fi network (following Apple’s instructions: http://support.apple.com/kb/HT5900)
-
Launch Xcode on the OS X system, and open the Xcode organizer.
-
Reboot the Apple TV by removing and re-inserting the power cable. Once the Apple logo has appeared (or shortly thereafter) connect the micro-USB cable to the OS X system.
-
In Xcode organizer, select the Apple TV device and view its Console log. It may be desirable to connect the mobile iOS device via another cable to capture its log as well.
-
When the Apple TV has reached the language selection screen, follow the instructions to complete the Touch Setup process.
-
Save the Apple TV log data to a text file.
-
Search the log file for data similar to the following:
Oct 10 15:48:07 Apple-TV Apple TV[24] : [TRDeviceSetupServer] Decompressed data: <62706c69 73743030 d2010203 04516151 70557365 747570d9 05060708 090a0b0c ….
-
Select the hexadecimal data (between the <> marks on that log entry) and convert to a binary file.
-
View that file using a plist editor. For example,
plutil -convert json -r -o -
-
The data recovered should look something like this: [keys and other data which may be unique or private have been redacted here]
{
"a" : "setup",
"p" : {
"au" : {
"h" : {
"x-apple-orig-url" : "https:\/\/p44-buy.itunes.apple.com\/WebObjects\/MZFinance.woa\/wa\/authenticate",
"edge-control" : "no-store, cache-maxage=0",
"x-set-apple-store-front" : "143441-1,19",
"Expires" : "Thu, 10 Oct 2013 22:47:49 GMT",
"apple-timing-app" : "402 ms",
"pod" : "44",
"Cache-Control" : "private, no-cache, no-store, no-transform, must-revalidate, max-age=0",
"x-apple-lokamai-no-cache" : "true",
"Content-Type" : "text\/xml; charset=UTF-8",
"x-apple-translated-wo-url" : "\/WebObjects\/MZFinance.woa\/wa\/authenticate",
"x-apple-jingle-correlation-key" : "--redacted--",
"Content-Encoding" : "gzip",
"x-apple-date-generated" : "Thu, 10 Oct 2013 22:47:48 GMT",
"x-apple-application-site" : "ST13",
"x-apple-application-instance" : "440051",
"x-apple-asset-version" : "0",
"Date" : "Thu, 10 Oct 2013 22:47:49 GMT",
"Set-Cookie" : "X-Dsid=--redacted--; version=\"1\"; expires=Fri, 10-Oct-2014 22:47:49 GMT; path=\/; domain=.apple.com, TrPod=3; version=\"1\"; expires=Fri, 10-Oct-2014 22:47:49 GMT; path=\/; domain=.apple.com, isPpuOptOut=; version=\"1\"; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=\/; domain=.apple.com, hsaccnt=1; version=\"1\"; path=\/WebObjects; domain=.apple.com, mz_at0---redacted--=--redacted--; version=\"1\"; expires=Wed, 30-Sep-2015 22:47:49 GMT; path=\/; domain=.apple.com, mz_at_ssl---redacted--=--redacted--; version=\"1\"; expires=Sat, 10-Oct-2015 22:47:49 GMT; path=\/; domain=.apple.com; secure, Pod=; version=\"1\"; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=\/; domain=.itunes.apple.com, X-Dsid=; version=\"1\"; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=\/; domain=.volume.itunes.apple.com, X-Dsid=; version=\"1\"; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=\/; domain=.vpp.itunes.apple.com, X-Token=; version=\"1\"; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=\/; domain=.volume.itunes.apple.com; secure, X-Token=; version=\"1\"; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=\/; domain=.vpp.itunes.apple.com; secure, Pod=44; version=\"1\"; expires=Sun, 10-Nov-2013 23:47:49 GMT; path=\/; domain=.apple.com, itspod=44; version=\"1\"; expires=Sun, 10-Nov-2013 23:47:49 GMT; path=\/; domain=.apple.com, mzf_in=440051; version=\"1\"; path=\/WebObjects; domain=.apple.com; secure, mzf_odc=ST1; version=\"1\"; expires=Thu, 10-Oct-2013 23:17:49 GMT; path=\/WebObjects; domain=.apple.com, mzf_dr=0; version=\"1\"; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=\/WebObjects; domain=.apple.com, ns-mzf-inst=179-11-80-157-121-8031-440051-44-st13; version=1; Max-Age=1800; path=\/; domain=.apple.com; httponly",
"x-webobjects-loadaverage" : "23",
"x-apple-request-store-front" : "143441-1,19 t:6",
"Content-Length" : "522",
"itspod" : "44"
},
"b" : {
"status" : 0,
"password" : "--redacted--",
"m-allowed" : true,
"creditBalance" : "1311811",
"freeSongBalance" : "1311811",
"clearToken" : "--redacted--",
"is-cloud-enabled" : "true",
"passwordToken" : "--redacted--",
"dsPersonId" : "--redacted--",
"creditDisplay" : "",
"accountInfo" : {
"address" : {
"firstName" : "David",
"lastName" : "Schuetz"
},
"accountKind" : "0",
"appleId" : "--redacted--"
}
}
},
"np" : "--redacted--",
"c" : "US",
"l" : "en",
"ns" : "--redacted--",
"ha" : "--redacted--",
"rp" : true,
"hg" : "00000000-0353-d139-58e8-619c235c480b",
"di" : true
}
}
Fix Information
A review of the affected binaries using IDA Pro indicates that these debug statements are hard-coded into the system. It may be possible for Apple to remotely change the “DEBUG LEVEL” at which the system is run, to prevent this data from being logged, however, it is not clear whether that will be possible.
Even if the logs are remotely disabled, the capability remains, and may be inadvertently or maliciously reactivated at a later date. It is expected that a fix will only be available by completely removing the logging commands from the binary and shipping a new release of the Apple TV software.
After reviewing the vulnerability, the vendor responded that the issue would be fixed in a future release of the Apple TV operating system.
The vendor has indicated that the issue was fixed in Apple TV system 6.1 (based on iOS 7.1), released on 10 March 2014. A review of the affected binaries in a pre-release version of 6.1 has indicated that the data is no longer written to the log.