QuaDream, 2nd Israeli Spyware Firm, Weaponizes iPhone Bug

ForcedEntry – the exploit of a zero-click iMessage zero day that circumvented Apple’s then-brand-new BlastDoor security feature starting a year ago – was picked apart not just by NSO Group with its Pegasus spyware but also by a newly uncovered, smaller smartphone-hacking toolmaker named QuaDream...

iphone-service.co.kr Cross Site Scripting vulnerability OBB-2359047

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

A worrying Etsy listing reveals the stalking potential of Apple’s AirTags

In April of 2021, Apple introduced AirTags to the world, making the small tracking devices—similar to a Tile— available for purchase at the end of that month. The circular, coin-like product is designed to be attached to or placed in objects that are commonly lost, such as keychains, wallets,...

CVE-2021-24043

A missing bound check in RTCP flag parsing code prior to WhatsApp for Android v2.21.23.2, WhatsApp Business for Android v2.21.23.2, WhatsApp for iOS v2.21.230.6, WhatsApp Business for iOS 2.21.230.7, and WhatsApp Desktop v2.2145.0 could have allowed an out-of-bounds heap read if a user sent a...

FontParser Disclosure

The vulnerability of the FontParser component in iPadOS, watchOS, iOS, tvOS, and Mac OS operating systems is related to reading data beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

Apple Releases iOS and macOS Updates to Patch Actively Exploited 0-Day Vulnerability

Apple on Wednesday released iOS 15.3 and macOS Monterey 12.2 with a fix for the privacy-defeating bug in Safari, as well as to contain a zero-day flaw, which it said has been exploited in the wild to break into its devices. Tracked as CVE-2022-22587, the vulnerability relates to a memory corrupti...

PT-2022-15538 · Apple · Macos Catalina +6

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 15.3 Apple iPadOS versions prior to 15.3 Apple tvOS versions prior to 15.3 Apple macOS Catalina versions prior to Security Update 2022-001 Apple macOS Monterey versions prior to 12.2 Apple macOS Big Sur versions...

TianySpy Malware Uses Smishing Disguised as Message From Telco

Trend Micro confirmed a new mobile malware infection chain targeting both Android and iPhone devices. The malware might have been designed to steal credentials associated with membership websites of major Japanese telecommunication services...

How to Transfer Your Data between iPhone and Computer Safely

By Owais Sultan There are many ways that you can use to transfer your photos, videos, and music from the iPhone… This is a post from HackRead.com Read the original post: How to Transfer Your Data between iPhone and Computer Safely...

PT-2022-1532 · Apple +6 · Macos Monterey +14

Name of the Vulnerable Software and Affected Versions: WebKitGTK and WPE WebKit versions prior to the fixed version Safari versions prior to 15.3 iOS versions prior to 15.3 iPadOS versions prior to 15.3 watchOS versions prior to 8.4 tvOS versions prior to 15.3 macOS Monterey versions prior to 12....

Apple Releases iPhone and iPad Updates to Patch HomeKit DoS Vulnerability

Apple on Wednesday rolled out software updates for iOS and iPadOS to remediate a persistent denial-of-service DoS issue affecting the HomeKit smart home framework that could be potentially exploited to launch ransomware-like attacks targeting the devices. The iPhone maker, in its release notes fo...

Faking an iPhone Reboot

Researchers have figured how how to intercept and fake an iPhone reboot: Well dissect the iOS system and show how its possible to alter a shutdown event, tricking a user that got infected into thinking that the phone has been powered off, but in fact, its still running. The "NoReboot" approach...

Apple iPadOS Input Verification Error Vulnerability

Apple iPadOS is a suite of operating systems for the iPad tablet computer from Apple USA. An input validation error vulnerability exists in Apple iOS and iPadOS that stems from the handling of maliciously crafted HomeKit accessory names could result in a denial of service...

A week in security (January 3 – 9)

Last week on Malwarebytes Labs: Ransomware attacks Finalsite, renders 8,000 school sites unreachable for days Patchwork APT caught in its own web Sophisticated phishing scheme spent years robbing authors of their unpublished work Google and Facebook fined $240 million for making cookies hard to...

How to Read Your iOS 15 App Privacy Report

Your iPhone now gives you lots of transparency into what your downloads are up to. Here's what to look out for...

This Week in Security News - January 7, 2022

This week, read about Log4j vulnerabilities in connected cars and charging stations and how iOS malware can fake iPhone shutdowns to snoop on cameras and microphones...

New iPhone malware spies via camera when device appears off

When removing malware from an iOS device, it is said that users need to restart the device to clear the malware from memory. That is no longer the case. Security researchers from ZecOps have created a new proof-of-concept PoC iPhone Trojan capable of doing "fun" things. Not only can it fake a...

Apple iPhone Malware Tactic Causes Fake Shutdowns to Enable Spying

In the world of mobile malware, simply shutting down a device can often wipe out any bad code, given that persistence after rebooting is a challenge for traditional malicious activity. But a new iPhone technique can hijack and prevent any shut-down process that a user initiates, simulating a real...

New Trick Could Let Malware Fake iPhone Shutdown to Spy on Users Secretly

Researchers have disclosed a novel technique by which malware on iOS can achieve persistence on an infected device by faking its shutdown process, making it impossible to physically determine if an iPhone is off or otherwise. The discovery — dubbed "NoReboot" — comes courtesy of mobile security...

CVE-2017-13880

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 11.2, watchOS 4.2. An application may be able to execute arbitrary code with kernel privilege...