CVE-2014-4352

Vulnerability

Address Book in Apple iOS prior to version 8 uses the device's hardware UID as the encryption key for stored contact data. This design flaw means that the confidentiality of the Address Book depends entirely on the secrecy of the hardware UID, which is a static identifier unique to each device. Affected versions include all iOS releases before 8.0.

Exploitation

An attacker who is physically proximate to the device can obtain the hardware UID through various means, such as forensic acquisition or direct access to the device's file system. Once the UID is known, the attacker can decrypt the Address Book database without needing the user's passcode or any additional authentication.

Impact

Successful exploitation results in the disclosure of all contact information stored in the Address Book, including names, phone numbers, email addresses, and any other associated data. This is a direct breach of confidentiality, with the attacker gaining access to sensitive personal information without requiring elevated privileges.

Mitigation

Apple addressed this vulnerability in iOS 8, which was released on September 17, 2014 [1]. Users should upgrade to iOS 8 or later to ensure their Address Book data is encrypted with a more secure key derivation mechanism. No workaround is available for devices running iOS versions prior to 8.