Skip to main content

Apple Confirms New Warning Affecting Almost All iPhone Users

Apple has already released the best iPhone of 2020, but now millions of iPhone owners — both old and new — need to be careful because the company has just confirmed a massive iOS security hole which impacts almost every iPhone on the planet.


A serious new iOS exploit impacts almost every iPhone and it has been running for years.

Following the publication of a devastating report from security firm ZecOps (covered here by Forbes), which claimed that every iPhone running a version of iOS 6 or newer is vulnerable to remote attacks, Apple has now confirmed the problem is real.
04/25 Update: Apple has now gone a step further in talking about this security breach and it has met a controversial response. In an official statement, the company played down ZecOps’ findings, saying: “In response, ZecOps has stood by its report and issued its own response disputing Apple’s statement. It wrote: “According to ZecOps data, there were triggers in-the-wild for this vulnerability on a few organizations. We want to thank Apple for working on a patch, and we’re looking forward to updating our devices once it’s available. ZecOps will release more information and POCs once a patch is available.” This additional information will make for fascinating reading once iOS 13.4.5 is released. This story seems to be far from over. Apple takes all reports of security threats seriously. We have thoroughly investigated the researcher’s report and, based on the information provided, have concluded these issues do not pose an immediate risk to our users. The researcher identified three issues in Mail, but alone they are insufficient to bypass iPhone and iPad security protections, and we have found no evidence they were used against customers. These potential issues will be addressed in a software update soon. We value our collaboration with security researchers to help keep our users safe and will be crediting the researcher for their assistance.”
So what are we dealing with? What ZecOps discovered is a serious vulnerability in Apple’s iOS Mail app which allows an attacker to remotely infect an iPhone and gain control over their inbox. In addition, not only did ZecOps find that the attacks can happen without an iPhone owner’s knowledge but triggers have been happening for more than two years, with the first trigger subsequently detected back in January 2018.
And there’s a further kicker: ZecOps found that the attacks are easier to perform on iOS 13 than previous generations of iOS. For example, ZecOps explains that with iOS 12, an attacker requires the iPhone user to open a malicious email. But with iOS 13, it can be triggered unassisted simply from the Mail app being opened in the background.
ZecOps has issued this infographic highlighting the massive iOS iPhone vulnerability
ZecOps
The good news? Apple has confirmed to Vice that it has managed to patch the vulnerability in the latest iOS 13.4.5 beta and it looks like the company will now accelerate its release (with iOS 13.4.1 the previous update, it appears that Apple will now be skipping some digits unless it pushes out a dedicated iOS 13.4.2 release instead).
Until then, ZecOps states that there are two ways to stay safe: disable the Mail app (Apple has a guide here) and use a third-party app instead. Notably, it found both Outlook and Gmail are not vulnerable to the exploit so there’s no need to bury your iPhone in a box and drop it in the sea.

Originally published at https://www.forbes.com.


Comments

Post a Comment

Popular posts from this blog

Ransomware's Dangerous New Trick Is Double-Encrypting Your Data

  Ransomware groups have always taken a more-is-more approach . If a victim pays a ransom and then goes back to business as usual-hit them again. Or don’t just encrypt a target’s systems; steal their data first, so you can threaten to leak it if they don’t pay up. The latest escalation? Ransomware hackers who encrypt a victim’s data twice at the same time. Double-encryption attacks have happened before, usually stemming from two separate ransomware gangs compromising the same victim at the same time. But antivirus company Emsisoft says it is aware of dozens of incidents in which the same actor or group intentionally layers two types of ransomware on top of each other. “The groups are constantly trying to work out which strategies are best , which net them the most money for the least amount of effort,” says Emsisoft threat analyst Brett Callow. “So in this approach you have a single actor deploying two types of ransomware. The victim decrypts their data and discovers it’s not act...
Post a Comment
Read more

Babuk ransomware is back, uses new version on corporate networks

  After announcing their exit from the ransomware business in favor of data theft extortion, the Babuk gang appears to have slipped back into their old habit of encrypting corporate networks. The criminals are currently using a new version of their file-encrypting malware and have moved the operation to a new leak site that lists a handful of victims. Gang’s still in the game The Babuk ransomware group became known at the beginning of the year but the gang says that their attacks had started in mid-October 2020, targeting companies across the world and demanding ransoms typically between $60,000 and $85,000 in bitcoin cryptocurrency. In some cases, victims were asked hundreds of thousands for data decryption. One of their most publicized victims is the Washinton DC’s Metropolitan Police Department (MPD). This attack likely pushed the threat actor into announcing its retirement from the ransomware business only to adopt another extortion model that did not include encryption....
Post a Comment
Read more

Microsoft Teams Phishing Attack Targets Office 365 Users

  Up to 50,000 Office 365 users are being targeted by a phishing campaign that purports to notify them of a “missed chat” from Microsoft Teams. Researchers are warning of a phishing campaign that pretends to be an automated message from Microsoft Teams. In reality, the attack aims to steal Office 365 recipients’ login credentials. Teams is Microsoft’s popular collaboration tool, which has particularly risen in popularity among remote workforces during the pandemic  — making it an attractive brand for attackers to impersonate. This particular campaign was sent to between 15,000 to 50,000 Office 365 users, according to researchers with Abnormal Security on Thursday. “Because Microsoft Teams is an instant-messaging service, recipients of this notification might be more apt to click on it so that they can respond quickly to whatever message they think they may have missed based on the notification,” said researchers in a Thursday analysis . The initial phishing email displays the name ...
Post a Comment
Read more