The curious tale of a fake Carrier.app
Summary: Google Project Zero analyzed a fake "My Vodafone" carrier app that was sideloaded onto iPhones using an enterprise certificate purchased through Apple's $299 Enterprise developer program, bypassing App Store review. The app bundled six privilege escalation exploits, five of them known public N-day exploits for older iOS versions and a sixth that targeted the DCP display co-processor on iPhone 12 and 13 devices, exploiting CVE-2021-30983, which Apple fixed in iOS 15.2 in December 2021.
Key Takeaway: The delivery chain required no zero-click exploit and no App Store compromise: an SMS, a disabled data connection, and a $299 enterprise certificate were enough to land a kernel exploit on a target's iPhone. The sixth exploit's target, the DCP co-processor, runs its own RTKit firmware and sits outside the kernel attack surface most security teams model.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2021-30983
- Related
- CVE-2021-30983: Apple iOS and iPadOS Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Jun 27, 20222022 0-day In-the-Wild Exploitation…so far Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026