Petronella Blog Archive

Visit our New Blog

Apple's Insomnia Vulnerability

Blog Post

A recently-patched vulnerability in iOS devices allowed apps to run in the background forever.

The vulnerability was nicknamed Insomnia.  It allowed malicious apps to run in the background with no timeout, even if the user manually closed it with the task switcher.  Apple has protocols imposed for applications that are supposed to shut them down after a number of minutes in order to keep apps from spying on your activity without permission.  Insomnia tricks an iPad or iPhone into thinking the system is being debugged, suspending the timeout protocol, letting a malicious app run continuously in the background to collect data on the user.  It can also drain the device's battery more quickly.  

Making this vulnerability even more insidious, it doesn't need the get-task-allow entitlement turned on, which, in English, means an Insomnia-exploiting app could easily slip through the App Store Review.

The Insomnia vulnerability has been patched as of iOS version 8.4.1, which was released recently.  So if you haven't updated your iPhone or iPad recently, now would be a good time to do it.