– Apple zero day attacks

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
Apple has released Safari for macOS Big Sur and Catalina to fix a zero-day vulnerability exploited in the wild to hack Macs. Apple has fixed two zero-day vulnerabilities affecting iOS, iPadOS, and macOS Monterrey that may have been actively exploited. The first exploit.
 
 

 

– Apple zero day attacks

 

Zero-day vulnerabilities addressed again. Apple provided the security update for the macOS Big Sur and Catalina to fix the zero-day vulnerabilities exploited in the wild. These bugs got used to hacking mac devices and now get patches. The bug allows to process the of maliciously crafted web content, and attackers can execute any wanted code.

Apple released the bulletin and informed users about the issue that possibly has already been exploited. This out-of-bounds [3] bug is the flaw creating an issue when the attacker can supply input to a program that causes the writing of the data past the end or before the beginning of a memory buffer. The program then crashes, data gets corrupted, and remote code can get executed. Apple states that the fix is available for the bug due to the improvement of bounds checking.

The company addresses that the vulnerability was disclosed to Apple by the researcher, who remains anonymous.

When this happened, it was not disclosed. However, the news comes after other incidents with zero-day vulnerabilities that have been addressed this week. This zero-day vulnerability is addressed, but Apple does not provide details on how the flaw was used in the attacks, but they state that it has been actively exploited before this patching. This year was big on the zero-days for Apple, however. The company has patched six other vulnerabilities this year. People to this day believe that Apple devices are immune to cyber threats and that machines cannot even be hacked.

However, Apple iPhones and other machines can be hacked and infected with spyware even when people do not click on any links and pop-up ads that can be malicious or just rogue and related to shady sponsored content. Apple devices can be compromised, and their sensitive data might be stolen via hacking software that is not requiring interaction with any content. There are various reports that iPhones belonging to journalists and hum rights activities have already been infected with malware from hacker groups like the NSO gang named Pegasus.

These targeted attacks are very sophisticated and cost millions of dollars to develop. Often these hackers use their products and campaigns to target specific individuals and organizations. Avoiding clicking on phishing links in messages may not protect the iPhone users enough because hackers have more advanced methods and develop particular malware like this that do not need to get click on malicious links in messages to make the execution of spyware.

Updating the Apple software can help to fix these issues with exploitable vulnerabilities and help avoid dealing with malware issues. Always keep the machine and program up to date. Ugnius Kiguolis is a professional malware analyst who is also the founder and the owner of 2-Spyware. At the moment, he takes over as Editor-in-chief. Contact Ugnius Kiguolis About the company Esolutions. Get the latest security news, full analysis of the newest computer threats, and easy-to-use prevention tips.

Subscribe to 2-spyware. Adware Ransomware Browser hijacker Mac viruses Trojans. Apple fixes exploited zero-day bugs with the Safari In January, Apple addressed actively exploited flaws that allowed the attacker to execute code with kernel privileges and track web browsing activities. In March, two zero-day vulnerabilities got patched by Apple. The misconception that Apple devices cannot be hacked or infected People to this day believe that Apple devices are immune to cyber threats and that machines cannot even be hacked.

Compare spyware removers.

 
 

Apple security updates fix 2 zero-days used to hack iPhones, Macs.

 
 

Apple has discovered two actively exploited zero-day vulnerabilities that could give attackers full access to a wide range of Apple devices, prompting the company to release security updates and urging users to apply the fixes immediately. According to Apple , the two zero-day out-of-bounds write bugs affect iPhone 6s and later, all iPad Pro models, iPad Air 2 and later, iPad 5 th generation and later, iPad mini 4 and later and 7 th generation iPod Touch.

Specifically, the vulnerabilities CVE and CVE lie in Kernel and WebKit, and attackers can exploit the vulnerabilities to execute arbitrary code with kernel privileges or use maliciously crafted web content to execute arbitrary code, respectively.

Over the last two days, Apple released iOS According to cybersecurity firm Malwarebytes, attackers could take complete control of devices if they were able to obtain kernel privileges, and they could leverage the flaw in Webkit—which powers all iOS web browsers and Safari—to executive arbitrary code if a user is tricked into going to a malicious website. In a blog , Malwarebytes researchers say it appears likely that these bugs were found in an active attack that chained the two together, first using the WebKit bug to run code before obtaining kernel privileges.

And even then, it depends on the anonymous researcher s that reported the vulnerabilities whether we will ever learn the technical details. Or when someone is able to reverse engineer the update that fixes the vulnerability. That being said, it seems likely that these vulnerabilities were found in an active attack that chained the two vulnerabilities together.

The attack could, for example, be done in the form of a watering hole or as part of an exploit kit. CVE could be exploited for initial code to be run. This code could be used to leverage CVE to obtain kernel privileges. Apple released few other details, but the U. Cybersecurity and Infrastructure Security Agency says attackers could exploit these bugs to take control of an affected device. The agency urges users and administrators in organizations with Apple devices deployed to apply the updates as soon as possible.

CISA also added the bugs to its list of known exploited vulnerabilities, mandating U. Your email address will not be published. Save my name, email, and website in this browser for the next time I comment. The distributed work model gives employees the flexibility they demand, but it can lead to shadow IT and introduce unnecessary security risk. In this webinar, subject matter experts discuss the transformation of the workplace, the rise of hybrid workers, the importance of open connectivit Effective trainings are the glue that can make the difference following a new technology implementation that your team has spent so much time, effo Get your latest project featured on TechDecisions Project of the Week.

Submit your work once and it will be eligible for all upcoming weeks. Search this website. This code could be used to leverage CVE to obtain kernel privileges Apple released few other details, but the U.

Leave a Reply Cancel reply Your email address will not be published. Featured Webcast: Collaboration 2. Pro Tips for Conducting End User Training Effective trainings are the glue that can make the difference following a new technology implementation that your team has spent so much time, effo Would you like your latest project featured on TechDecisions as Project of the Week?

Apply Today! Twitter Facebook Linkedin. Enter Today!