Tag Archive for: iPhone’s

Apple: Update your iPhones and iPads urgently to avoid being hacked

/in


A

pple is urging all iPhone and iPad users worldwide to urgently update their devices to iOS 16.5 and iPad OS 16.5, or risk being hacked by cybercriminals.

The tech giant issued advice last week warning that there are three cybersecurity flaws, known commonly as “zero-day exploits”, that are being actively exploited by hackers and cybercriminals on unpatched devices.

Source…

Apple releases fixes for three zero-day exploits in Macs, iPhones

/in


Apple released a slew of security updates on May 18, three of which are for zero-day vulnerabilities in a number of its popular devices.

Not much has been released about the vulnerabilities, but the update said that “Apple is aware of a report that this issue may have been actively exploited.”

The first bug, tracked as CVE-2023-32409, can allow a remote attacker to break out of the Web Content sandbox; the second vulnerability, CVE-2023-28204, may disclose sensitive information; while the third vulnerability, CVE-2023-32373, may lead to arbitrary code execution while processing maliciously crafted web content.

The security vulnerabilities were all found and addressed in the WebKit for several models of iPhones (iOS 16.5, which runs on iPhone 8 and later), iPads (iPadOS 16.5, which runs on iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later), Macs (Ventura 13.4, Big Sur 11.7.7 and Monterey 12.6.6), Apple Watches (Series 4 and later) and Apple TV (tvOS 16.5), as well as Safari 16.5 for macOS Big Sur and Monterey). 

Also affected are all models using iOS 15.7.6 and iPadOS 15.7.6, which include iPhone 6, iPhone 7, iPhone SE, iPad Air 2, iPad mini (4th generation, and iPod touch (7th generation).

There have been a number of zero-day vulnerabilities targeting Apple products recently, with the most recent patch coming in April for two zero-day vulnerabilities, which the Cybersecurity and Infrastructure Security Agency added to its Known Exploited Vulnerabilities (KEV) catalog.

The security community also learned in April of three more zero-click exploits targeting iOS devices from the notorious NSO Group, makers of the Pegusus spyware.

Source…

Israel-based Spyware Firm QuaDream Targets High-Risk iPhones with Zero-Click Exploit

/in


Threat actors using hacking tools from an Israeli surveillanceware vendor named QuaDream targeted at least five members of civil society in North America, Central Asia, Southeast Asia, Europe, and the Middle East.

According to findings from a group of researchers from the Citizen Lab, the spyware campaign was directed against journalists, political opposition figures, and an NGO worker in 2021. The names of the victims were not disclosed.

It’s also suspected that the company abused a zero-click exploit dubbed ENDOFDAYS in iOS 14 to deploy spyware as a zero-day in version 14.4 and 14.4.2. There is no evidence that the exploit has been used after November 2021.

ENDOFDAYS “appears to make use of invisible iCloud calendar invitations sent from the spyware’s operator to victims,” the researchers said, adding the .ics files contain invites to two backdated and overlapping events so as to not alert the users.

The attacks are suspected to have leveraged a quirk in iOS 14 that any iCloud calendar invitation with a backdated time received by the phone is automatically processed and added to the users’ calendar without any notification or prompt.

The Microsoft Threat Intelligence team is tracking QuaDream as DEV-0196, describing it as a private sector offensive actor (PSOA). While the cyber mercenary company is not directly involved in targeting, it is known to sell its “exploitation services and malware” to government customers, the tech giant assessed with high confidence.

The malware, named KingsPawn, contains a monitor agent and the primary malware agent, both of which are Mach-O files written in Objective-C and Go, respectively.

While the monitor agent is responsible for reducing the forensic footprint of the malware to evade detection, the main agent comes with capabilities to gather device information, cellular and Wi-Fi data, harvest files, access camera in the background, access location, call logs, and iOS Keychain, and even generate an iCloud time-based one-time password (TOTP).

Other samples support recording audio from phone calls and the microphone, running queries in SQL databases, and cleaning up forensic trails, such as deleting all calendar events from two years prior…

Source…

Apple fixes 2 zero-day bugs exploited to hack iPhones, Macs

/in


Apple has fixed two new zero-day security vulnerabilities exploited in attacks to compromise iPhones, Macs, and iPads, in its latest software update.

According to BleepingComputer, the two zero-day security vulnerabilities were addressed in iOS 16.4.1, iPadOS 16.4.1, macOS Ventura 13.3.1, and Safari 16.4.1 with improved input validation and memory management.

The first security flaw is an IOSurfaceAccelerator that could lead to the corruption of data, a crash, or code execution.

Successful exploitation enables attackers to execute arbitrary code with kernel privileges on targeted devices by using a maliciously crafted app, said the report.

The second zero-day vulnerability is a WebKit that allows data corruption or arbitrary code execution when freed memory is reused.

An attacker can exploit this flaw by tricking targets into loading malicious web pages under their control, resulting in code execution on compromised systems.

Meanwhile, researchers have tracked 55 zero-day vulnerabilities that were exploited in 2022 by the hackers, mostly targeting Microsoft, Google and Apple products.

According to information security company Mandiant report, products of Microsoft, Google and Apple made up the majority of zero-day vulnerabilities in 2022, consistent with the previous years, and the most exploited product types were operating systems (19), followed by browsers (11), security, IT, and network management products (10), and mobile OS (six).

Source…