A researcher has revealed how a vulnerability within the AirDrop service can be exploited to compromise a victim's Apple device.
The revelation coincides with the arrival of the latest version of Apple's mobile operating system. Released Wednesday, iOS 9 fixes that serious security flaw, making it crucial for users to update from in previous versions.
Apple's, due September 30, also fixes the problem. Users should update their devices as soon as possible, and make sure the Airdrop service is off until updates have been installed.
Australian security researcher Mark Dowd from Azimuth Security demonstrated the existence of the vulnerability.
Speaking to Forbes, Dowd said the attack can take place when a hacker is in range of an AirDrop user. Once the vulnerability is exploited, an attacker could issue a malware payload via a "directory traversal attack" -- that is, entering the device's core operating system -- before remotely altering configuration files to ensure the exploit still works even if an incoming AirDrop file is rejected by a user.
The AirDrop service uses proprietary software that enables the transfer of content including images, videos and GPS data with others nearby who also have an Apple device. While turned off by default, the platform can be enabled from the home screen.
After reboot, the researcher was able to alter the Springboard home screen management system to trick the operating system into accepting a fraudulent security certificate and thus to bypass Apple's safeguards. Malware was then installed in the third-party application directory.
While malicious third-party apps installed on an iPhone or Mac are sandbox-restricted, as the app has been signed, an attacker could still steal valuable data such as GPS coordinates, messages or contact lists or could take control of the device's camera, depending on the app entitlements in place.
In a video posted to YouTube, Dowd demonstrates his attack on an iPhone running iOS 8.4.1.
This story originally posted as "Apple AirDrop flaw leaves users vulnerable to exploit" on ZDNet.