A critical iPhone and iPad bug that lurked for 8 years may be under active attack:
A critical bug that has lurked in iPhones and iPads for eight years is under active attack by sophisticated hackers who are using a zero-day exploit to hack the devices of high-profile targets, a security firm reported on Wednesday.
The exploit is triggered by sending booby-trapped emails that, in some cases, require no interaction at all and, in other cases, require only that a user open the message, researchers from ZecOps said in a post. The malicious emails allow attackers to run code in the context of the default mail apps, which make it possible to read, modify, or delete messages. The researchers suspect the attackers are combining the zero-day with a separate exploit that gives full control over the device. The vulnerability dates back to iOS 6 released in 2012. Attackers have been exploiting the bug since 2018 and possibly earlier.
"With very limited data we were able to see that at least six organizations were impacted by this vulnerability— and the full scope of abuse of this vulnerability is enormous," ZecOps researchers wrote. "We are confident that a patch must be provided for such issues with public triggers ASAP."
Targets from the six organizations include:
- Individuals from a Fortune 500 organization in North America
- An executive from a carrier in Japan
- A VIP from Germany
- Managed security services providers in Saudi Arabia and Israel
- A journalist in Europe
- Suspected: An executive from a Swiss enterprise
Apple has currently patched the flaw in the beta for iOS 13.4.5. At the time this post went live, a fix in the general release had not yet been released.
Malicious mails that trigger the flaw work by consuming device memory and then exploiting a heap overflow, which is a type of buffer overflow that exploits an allocation flaw in memory reserved for dynamic operations. By filling the heap with junk data, the exploit is able to inject malicious code that then gets executed. The code triggers strings that include 4141...41, which are commonly used by exploit developers.
A protection known as address space layout randomization prevents attackers from knowing the memory location of this code and thus executing in a way that takes control of the device. As a result, the device or application merely crashes. To overcome this security measure, attackers must exploit a separate bug that reveals the hidden memory location.
Related Stories
Apple Pushes Back Against Zero-Day Exploit Claims:
Company said there is no evidence that iOS bugs revealed by ZecOps earlier this week were ever used against customers.
Apple has pushed back against claims that two zero-day bugs in its iPhone iOS have been exploited for years, saying it's found no evidence to support such activity.
Apple officials made the statement in response to a widely disseminated report published Wednesday by ZecOps, which claimed that two Apple iOS zero-day security vulnerabilities affecting its Mail app on iPhones and iPads already had been exploited in the wild since 2018 by an "advanced threat operator."
"Both vulnerabilities exist at least since iOS 6 – (issue date: September 2012) – when iPhone 5 was released," ZecOps said in its report.
However, Apple said in a statement to Bloomberg's Apple correspondent Mark Gurman that he posted on Twitter that this is just not true."We have thoroughly investigated the researcher's report and, based on the information provided, have concluded these issues do not pose an immediate risk to our users," the company said in the statement.
Also at www.securityweek.com
Previously: A Critical iPhone and IPad Bug That Lurked for Eight Years May be Under Active Attack
(Score: 0) by Anonymous Coward on Friday April 24 2020, @04:11AM (1 child)
To get the contact tracing functionality installed.
(Score: 0) by Anonymous Coward on Saturday April 25 2020, @01:26AM
It's lready been there for years.