CVE-2017-14487
📋 TL;DR
This vulnerability allows attackers to impersonate legitimate users by intercepting network traffic and modifying authentication data stored locally on mobile devices. It affects users of the OhMiBod Remote app on both Android and iOS platforms. Attackers can gain unauthorized access to user accounts and potentially control connected devices.
💻 Affected Systems
- OhMiBod Remote app
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover allowing attackers to control connected OhMiBod devices, access personal user data, and potentially compromise other linked accounts or services.
Likely Case
Unauthorized access to user accounts enabling control of connected devices and potential exposure of personal information stored in the app.
If Mitigated
Limited impact if network traffic is encrypted and local storage is properly secured, though some risk remains from physical device access.
🎯 Exploit Status
Exploitation requires network sniffing capability and physical/remote access to modify local storage files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version
Vendor Advisory: https://dl.acm.org/citation.cfm?id=3139942&preflayout=flat
Restart Required: Yes
Instructions:
Update OhMiBod Remote app to latest version from official app stores
Uninstall and reinstall app if update not available
🔧 Temporary Workarounds
Disable app network permissions
androidPrevent app from accessing network to block traffic interception
Use VPN on untrusted networks
allEncrypt all network traffic to prevent sniffing
🧯 If You Can't Patch
- Uninstall the OhMiBod Remote app completely
- Avoid using the app on untrusted networks or public WiFi
🔍 How to Verify
Check if Vulnerable:
Check if OhMiBod Remote app is installed and review app version against latest available in app storeCheck Version:
Check app version in device settings > Apps > OhMiBod RemoteVerify Fix Applied:
Verify app has been updated to latest version and test authentication functionality📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts from same device
- Unusual device control patterns
Network Indicators:
- Unencrypted authentication traffic to OhMiBod API servers
- Suspicious network sniffing tools on same network
SIEM Query:
source="mobile_device" app="OhMiBod Remote" (event="authentication_failure" OR event="unusual_activity")