Apple Updates iOS To Close Three Separate 0days That Were Being Exploited

from the throw-away-your-phone dept

As you may have heard, if you have an iOS device (iPhone, iPad, even iPod Touch) you should be updating your devices, like a few hours ago. Seriously, if you haven’t done it yet, stop reading and go update. The story behind this update is quite incredible, and is detailed in a great article over at Motherboard by Lorenzo Franceschi-Bicchierai. Basically after someone (most likely a gov’t) targeted Ahmed Mansoor, a human rights activist in the United Arab Emirates with a slightly questionable text (urging him to click on a link to get info about prison torture), a team of folks from Citizen Lab (who have exposed lots of questionable malware) and Lookout (anti-malware company) got to work on the text and figured out what it did. And, basically the short version is that the single click exploits three separate 0days vulnerabilities to effectively take over your phone in secret. All of it. It secretly jailbreaks the phone without you knowing it and then accesses basically everything.

?It basically steals all the information on your phone, it intercepts every call, it intercepts every text message, it steals all the emails, the contacts, the FaceTime calls. It also basically backdoors every communications mechanism you have on the phone,? Murray explained. ?It steals all the information in the Gmail app, all the Facebook messages, all the Facebook information, your Facebook contacts, everything from Skype, WhatsApp, Viber, WeChat, Telegram?you name it.?

So that’s great.

The researches believe they’ve tracked back the exploit to a secretive hacking company called NSO Group. The full Citizen Lab writeup on all of this is quite fascinating as well. They estimate that this exploit from NSO probably costs in the range of a million dollars on the market, though obviously it’s closed now. That doesn’t mean that NSO or others don’t have other exploits up their sleeves.

The report also notes that this kind of exploit is probably just used by nation states right now, but there’s nothing to say that it couldn’t move down the stack before too long, letting all sorts of mischievous characters look to basically completely pwn your phone. Pretty scary stuff, and yet another reminder of why it’s so dangerous that folks like the NSA are hoarding 0days, rather than revealing them, and that the FBI is trying to force tech companies to break encryption and other tools that are necessary to block these kinds of attacks.

Filed Under: , , , , , , ,
Companies: citizen lab, lookout, nso

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Apple Updates iOS To Close Three Separate 0days That Were Being Exploited”

Subscribe: RSS Leave a comment
Anonymous Coward says:

Re: Not all bad news

If by “more useful”, you mean “not suitable for internet surfing”… because if you can use them to pwn your own device by visiting a website, anyone else can as well.

So unless your jailbreak plans include “avoiding the public internet” – I’m not sure it makes them more useful at all. In fact, it basically does the opposite – rendering them “unsafe for any use”.

Anonymous Coward says:

Re: Re: Not all bad news

Devices that are supported by Apple don’t receive security updates so yes, they are “not suitable for internet surfing”. The idea is to turn these bricks back into useful and possibly even secure devices with new software. There are millions of otherwise functioning iOS devices that cannot be improved because Apple holds the key.

nasch (profile) says:

Re: Re: Not all bad news

You mean how Apple will support a iPhone for at least 4 years, while Google only suggests 18 months with Android!!!

Support is up to the carrier. As you say, Google releases security and OS updates but it’s up to the carriers to push them out. There are advantages and disadvantages to the Android ecosystem compared to Apple.

Add Your Comment

Your email address will not be published.

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...