Nepal | June 03, 2020

Flaw in iPhone, iPads may have allowed hackers to steal data for years

Associated Press
Share Now:

WASHINGTON/SAN FRANCISCO: Apple Inc is planning to fix a flaw that a security firm said may have left more than half a billion iPhones vulnerable to hackers.

The bug, which also exists on iPads, was discovered by ZecOps, a San Francisco-based mobile security forensics company, while it was investigating a sophisticated cyberattack against a client that took place in late 2019. Zuk Avraham, ZecOps’ chief executive, said he found evidence the vulnerability was exploited in at least six cybersecurity break-ins.

An Apple spokesman acknowledged that a vulnerability exists in Apple’s software for email on iPhones and iPads, known as the Mail app, and that the company had developed a fix, which will be rolled out in a forthcoming update on millions of devices it has sold globally.

Apple declined to comment on Avraham’s research, which was published on Wednesday, that suggests the flaw could be triggered from afar and that it had already been exploited by hackers against high-profile users.

Avraham said he found evidence that a malicious program was taking advantage of the vulnerability in Apple’s iOS mobile operating system as far back as January 2018. He could not determine who the hackers were and Reuters was unable to independently verify his claim.

To execute the hack, Avraham said victims would be sent an apparently blank email message through the Mail app forcing a crash and reset. The crash opened the door for hackers to steal other data on the device, such as photos and contact details.

ZecOps claims the vulnerability allowed hackers to remotely steal data off iPhones even if they were running recent versions of iOS. By itself, the flaw could have given access to whatever the Mail app had access to, including confidential messages.

Avraham, a former Israeli Defense Force security researcher, said he suspected that the hacking technique was part of a chain of malicious programs, the rest undiscovered, which could have given an attacker full remote access. Apple declined to comment on that prospect.

ZecOps found the Mail app hacking technique was used against a client last year. Avraham described the targeted client as a “Fortune 500 North American technology company,” but declined to name it. They also found evidence of related attacks against employees of five other companies in Japan, Germany, Saudi Arabia, and Israel.

Avraham based most of his conclusions on data from “crash reports,” which are generated when programs fail in mid-task on a device. He was then able to recreate a technique that caused the controlled crashes.

Two independent security researchers who reviewed ZecOps’ discovery found the evidence credible, but said they had not yet fully recreated its findings.

Patrick Wardle, an Apple security expert and former researcher for the US National Security Agency, said the discovery “confirms what has always been somewhat of a rather badly kept secret: that well-resourced adversaries can remotely and silently infect fully patched iOS devices.”

Because Apple was not aware of the software bug until recently, it could have been very valuable to governments and contractors offering hacking services. Exploit programs that work without warning against an up-to-date phone can be worth more than $1 million.

While Apple is largely viewed within the cybersecurity industry as having a high standard for digital security, any successful hacking technique against the iPhone could affect millions due to the device’s global popularity. In 2019, Apple said there were about 900 million iPhones in active use.

Bill Marczak, a security researcher with Citizen Lab, a Canada-based academic security research group, called the vulnerability discovery “scary.”

“A lot of times, you can take comfort from the fact that hacking is preventable,” said Marczak. “With this bug, it doesn’t matter if you’ve got a PhD in cybersecurity, this will eat your lunch.”


Follow The Himalayan Times on Twitter and Facebook

Recommended Stories:

More from The Himalayan Times:

Coronavirus cases in Karnali Province jump to 252 with 54 new infections

KATHMANDU: Fifty-four additional people have tested positive for the coronavirus infection in Karnali Province, on Tuesday. As of today, five districts of the province have witnessed cases of COVID-19. With the newly confirmed infections, number of cases has reached 252 in the province. Until Read More...

Coronavirus study says low humidity aids contagion, will coming humid months help Nepal?

KATHMANDU: A recent study claims that low humidity aids coronavirus outbreak and might recur every year. The study provides evidence that lower relative humidity is associated with Covid-19 cases, under the conditions of high temperature in the southern hemisphere summer. However, it is to be tak Read More...

Fear-triggered attack on healthcare worker in Doti

DHANGADHI: A healthcare worker carrying medical supplies to a health post has been attacked amid the fear of coronavirus transmission in Doti. According to health coordinator at Shikhar Municipality-9 Harish Shah, Auxiliary Health Worker (AHW) Ramesh Kunwar, stationed at Dankot Health Post in the Read More...

28 new cases of coronavirus infection detected in Sudurpaschim Province

DHANGADHI: As many as 28 new cases of the coronavirus infection have been detected in Sudurpaschim Province, on Tuesday. The cases of contraction were confirmed after RT-PCR tests were conducted at the Surkhet and Dhangadhi-based laboratories. Among the infected, ten persons are natives of Ach Read More...

Quarantine facilities in Sudurpaschim crammed as returnees from India surge

DHANGADHI: The quarantine facilities across Sudurpaschim Province have become over-crowded due to the influx of incoming Nepali migrant workers from India. As recorded at the Administration Office in Kailali, approximately 2,000 to 5,000 migrant workers have been regularly entering the provin Read More...

VIDEO: 288 coronavirus cases reported, tally hits 2099

Kathmandu, June 2 Nepal’s coronavirus transmission cases speed past 2000 with 288 infections detected on Tuesday Watch the video here: https://youtu.be/Y5Q2RAhT3-8   Read More...

Six new coronavirus-cases reported in Kathmandu valley on Tuesday

KATHMANDU: The Health Ministry confirmed six cases of coronavirus-infection in the valley on Tuesday. Of the total 288 cases reported today, six hail from Kathmandu valley. Four health workers from Kathmandu Medical College, three females aged 24-32 years, and a 28-year-old male, have been dia Read More...

Sancho not booked for Floyd protest, slogans being reviewed, says DFB

BERLIN: Borussia Dortmund winger Jadon Sancho was not booked for his protest against the death of American George Floyd by a policeman but because he removed his shirt during the game, the German Football Association (DFB) clarified on Monday. Sancho removed his shirt during a goal celebrat Read More...