An iOS zero-click radio proximity exploit odyssey
Summary: Google Project Zero researcher Ian Beer spent roughly six months of 2020 building a wormable radio-proximity exploit that gave him complete control over any iPhone in his vicinity, using a single memory corruption vulnerability - a buffer overflow in C++ kernel code parsing untrusted data - to defeat all mitigations on an iPhone 11 Pro. The issue was fixed before Apple launched Privacy-Preserving Contact Tracing in iOS 13.5 in May 2020, and Beer states he found it through manual reverse engineering with no evidence it was exploited in the wild.
Key Takeaway: One person working alone in a bedroom produced a capability to fully compromise iPhones in close proximity, and with directional antennas, higher transmission power and sensitive receivers the range of such attacks can be considerable. Beer notes exploit vendors appeared to take notice of the fixes, and that the teams supplying the global cyberweapons trade are well-resourced collaborators, not lone individuals.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026