Security researchers have released a proof-of-concept exploit for a critical vulnerability in the iOS Apple HomeKit framework that if exploited, could lead to a Denial-of-Service (DoS). HomeKit is a framework that iOS users can use to control compatible home appliances from their mobile devices (iPhone/iPad). The issue named “doorLock”, is triggered by an attacker changing the name of a HomeKit device to a string longer than 500,000 characters, which the operating system can’t process, leading to a DoS that can only be stopped with a hard reset. Although the PoC exploit was demonstrated using a custom iOS application, in-the-wild, an attacker would most likely exploit this vulnerability by the use Home invitations, which wouldn’t require the user to own a HomeKit device at all. iOS users should be advised that a forced hard reset is not an end-all-be-all solution to this problem, due to the fact that resetting the device will cause all stored data to be removed and only recoverable via a backup. So, if a user experiences this exploit, but doesn’t have a backup of their current data, they will lose it all after the reset. And even so, once the user signs back into the iCloud account associated with the HomeKit device, the flaw will start over again. All this being said, the vulnerability can only be exploited by manually inviting someone who has already gained access to the network framework. There is no update or patch that technically fixes this vulnerability, and researchers recommend that users should focus all efforts on preventing the DoS in the first place by staying vigilant and monitoring for suspicious Home invitations coming from spoofed Apple services or HomeKit product email addresses.