SoylentNews

20/04/24/179208 story

Apple Pushes Back Against Zero-Day Exploit Claims

posted by janrinok on Friday April 24 2020, @11:06PM   
from the disagreement dept.

upstart writes in with an IRC submission for Bytram:

Apple Pushes Back Against Zero-Day Exploit Claims:

Company said there is no evidence that iOS bugs revealed by ZecOps earlier this week were ever used against customers.

Apple has pushed back against claims that two zero-day bugs in its iPhone iOS have been exploited for years, saying it's found no evidence to support such activity.

Apple officials made the statement in response to a widely disseminated report published Wednesday by ZecOps, which claimed that two Apple iOS zero-day security vulnerabilities affecting its Mail app on iPhones and iPads already had been exploited in the wild since 2018 by an "advanced threat operator."

"Both vulnerabilities exist at least since iOS 6 – (issue date: September 2012) – when iPhone 5 was released," ZecOps said in its report.
However, Apple said in a statement to Bloomberg's Apple correspondent Mark Gurman that he posted on Twitter that this is just not true.

"We have thoroughly investigated the researcher's report and, based on the information provided, have concluded these issues do not pose an immediate risk to our users," the company said in the statement.

Also at www.securityweek.com

Previously: A Critical iPhone and IPad Bug That Lurked for Eight Years May be Under Active Attack

---

Original Submission

Related Stories

A Critical iPhone and IPad Bug That Lurked for Eight Years May be Under Active Attack 2 comments

upstart writes in with an IRC submission for Bytram:

A critical iPhone and iPad bug that lurked for 8 years may be under active attack:

A critical bug that has lurked in iPhones and iPads for eight years is under active attack by sophisticated hackers who are using a zero-day exploit to hack the devices of high-profile targets, a security firm reported on Wednesday.

The exploit is triggered by sending booby-trapped emails that, in some cases, require no interaction at all and, in other cases, require only that a user open the message, researchers from ZecOps said in a post. The malicious emails allow attackers to run code in the context of the default mail apps, which make it possible to read, modify, or delete messages. The researchers suspect the attackers are combining the zero-day with a separate exploit that gives full control over the device. The vulnerability dates back to iOS 6 released in 2012. Attackers have been exploiting the bug since 2018 and possibly earlier.

"With very limited data we were able to see that at least six organizations were impacted by this vulnerability— and the full scope of abuse of this vulnerability is enormous," ZecOps researchers wrote. "We are confident that a patch must be provided for such issues with public triggers ASAP."

Targets from the six organizations include:

• Individuals from a Fortune 500 organization in North America
• An executive from a carrier in Japan
• A VIP from Germany
• Managed security services providers in Saudi Arabia and Israel
• A journalist in Europe
• Suspected: An executive from a Swiss enterprise

Apple has currently patched the flaw in the beta for iOS 13.4.5. At the time this post went live, a fix in the general release had not yet been released.

• Fuck you, Apple Fuck you, Apple (Score: 1, Funny) by Anonymous Coward on Friday April 24 2020, @11:28PM (1 child)

  by Anonymous Coward on Friday April 24 2020, @11:28PM (#986748)

  The truth... you're not holding it right.

  • Re:Fuck you, Apple (Score: 0) by Anonymous Coward on Friday April 24 2020, @11:52PM

    by Anonymous Coward on Friday April 24 2020, @11:52PM (#986760)

    "You're holding it right."
    - Hacker

    Parent

• Comment Below Threshold

  Someone is working full-time; suspicious claims (Score: -1, Offtopic) by Anonymous Coward on Saturday April 25 2020, @03:11AM

  by Anonymous Coward on Saturday April 25 2020, @03:11AM (#986819)

  In order to estimate properly the really pernicious influence which the Press can exercise one had to study this infamous Jewish method whereby honourable and decent people were besmirched with mud and filth, in the form of low abuse and slander, from hundreds and hundreds of quarters simultaneously, as if commanded by some magic formula.

  These highway robbers would grab at anything which might serve their evil ends.

  They would poke their noses into the most intimate family affairs and would not rest until they had sniffed out some petty item which could be used to destroy the reputation of their victim. But if the result of all this sniffing should be that nothing derogatory was discovered in the private or public life of the victim, they continued to hurl abuse at him, in the belief that some of their animadversions would stick even though refuted a thousand times.

  -- POLITICAL REFLECTIONS ARISING OUT OF MY SOJOURN IN VIENNA

• Do not pose an immediate risk to our users (Score: 1, Insightful) by Anonymous Coward on Saturday April 25 2020, @08:59AM

  by Anonymous Coward on Saturday April 25 2020, @08:59AM (#986869)

  Exact words.