Apple owners, be aware: A vulnerability has been discovered in the kernel of Darwin, an open-source component of both the OS X and iOS operating systems.
According to Kaspersky Lab, the “Darwin Nuke” vulnerability leaves a swath of Macs and iPhones/iPads exposed to remotely-activated denial of service (DoS) attacks, including iPhone 5s, iPad Air and iPad mini 2.
The news comes hard on the heels of another serious flaw, dubbed "Phantom" by FireEye reseachers.
With a proper exploit, attackers can melt down a device by sending just one incorrect network packet to the victim. The system will crash, which can of course damage the user’s device and impact any corporate network to which it is connected.
To cause a crash, the bad packets must meet three criteria: The size of the IP header should be 60 bytes; the size of the IP payload should be at least 65 bytes; and there should be errors in the IP options (invalid size of option, class, etc.).
Routers and firewalls would usually drop incorrect packets with invalid option sizes, but the firm’s researchers discovered several combinations of incorrect IP options that are able to pass through the Internet routers.
When the conditions laid down in the code are met, the panic function in the Apple device is engaged, and the system is shut down in emergency mode. This happens because the internal kernel structures have been changed and the new buffer size is insufficient to store a newly-generated ICMP packet.
A true professional can easily use it to compromise a user's device. “At first sight, it is very hard to exploit this bug, as the conditions attackers need to meet are not trivial ones,” said Anton Ivanov, senior malware analyst at Kaspersky Lab, in an email. “But persistent cyber-criminals can do so, breaking down devices or even affecting the activity of corporate networks.”
Apple has fixed the vulnerability, so it doesn’t exist in OS X 10.10.3 and iOS 8.3. Users should update their devices as soon as possible.