Apple Releases iOS and macOS Updates to Patch Actively Exploited 0-Day Vulnerability

Apple on Wednesday released iOS 15.3 and macOS Monterey 12.2 with a fix for the privacy-defeating bug in Safari, as well as to contain a zero-day flaw, which it said has been exploited in the wild to break into its devices. Tracked as CVE-2022-22587, the vulnerability relates to a memory corrupti...

PT-2022-15538 · Apple · Macos Catalina +6

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 15.3 Apple iPadOS versions prior to 15.3 Apple tvOS versions prior to 15.3 Apple macOS Catalina versions prior to Security Update 2022-001 Apple macOS Monterey versions prior to 12.2 Apple macOS Big Sur versions...

TianySpy Malware Uses Smishing Disguised as Message From Telco

Trend Micro confirmed a new mobile malware infection chain targeting both Android and iPhone devices. The malware might have been designed to steal credentials associated with membership websites of major Japanese telecommunication services...

How to Transfer Your Data between iPhone and Computer Safely

By Owais Sultan There are many ways that you can use to transfer your photos, videos, and music from the iPhone… This is a post from HackRead.com Read the original post: How to Transfer Your Data between iPhone and Computer Safely...

PT-2022-1532 · Apple +6 · Macos Monterey +14

Name of the Vulnerable Software and Affected Versions: WebKitGTK and WPE WebKit versions prior to the fixed version Safari versions prior to 15.3 iOS versions prior to 15.3 iPadOS versions prior to 15.3 watchOS versions prior to 8.4 tvOS versions prior to 15.3 macOS Monterey versions prior to 12....

Apple Releases iPhone and iPad Updates to Patch HomeKit DoS Vulnerability

Apple on Wednesday rolled out software updates for iOS and iPadOS to remediate a persistent denial-of-service DoS issue affecting the HomeKit smart home framework that could be potentially exploited to launch ransomware-like attacks targeting the devices. The iPhone maker, in its release notes fo...

Faking an iPhone Reboot

Researchers have figured how how to intercept and fake an iPhone reboot: Well dissect the iOS system and show how its possible to alter a shutdown event, tricking a user that got infected into thinking that the phone has been powered off, but in fact, its still running. The "NoReboot" approach...

Apple iPadOS 输入验证错误漏洞

Apple iPadOS is a suite of operating systems for the iPad tablet computer from Apple USA. An input validation error vulnerability exists in Apple iOS and iPadOS that stems from the handling of maliciously crafted HomeKit accessory names could result in a denial of service...

A week in security (January 3 – 9)

Last week on Malwarebytes Labs: Ransomware attacks Finalsite, renders 8,000 school sites unreachable for days Patchwork APT caught in its own web Sophisticated phishing scheme spent years robbing authors of their unpublished work Google and Facebook fined $240 million for making cookies hard to...

How to Read Your iOS 15 App Privacy Report

Your iPhone now gives you lots of transparency into what your downloads are up to. Here's what to look out for...

This Week in Security News - January 7, 2022

This week, read about Log4j vulnerabilities in connected cars and charging stations and how iOS malware can fake iPhone shutdowns to snoop on cameras and microphones...

New iPhone malware spies via camera when device appears off

When removing malware from an iOS device, it is said that users need to restart the device to clear the malware from memory. That is no longer the case. Security researchers from ZecOps have created a new proof-of-concept PoC iPhone Trojan capable of doing "fun" things. Not only can it fake a...

Apple iPhone Malware Tactic Causes Fake Shutdowns to Enable Spying

In the world of mobile malware, simply shutting down a device can often wipe out any bad code, given that persistence after rebooting is a challenge for traditional malicious activity. But a new iPhone technique can hijack and prevent any shut-down process that a user initiates, simulating a real...

New Trick Could Let Malware Fake iPhone Shutdown to Spy on Users Secretly

Researchers have disclosed a novel technique by which malware on iOS can achieve persistence on an infected device by faking its shutdown process, making it impossible to physically determine if an iPhone is off or otherwise. The discovery — dubbed "NoReboot" — comes courtesy of mobile security...

CVE-2017-13880

A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 11.2, watchOS 4.2. An application may be able to execute arbitrary code with kernel privilege...

The vulnerability of the Crash Reporter component in operating systems such as Mac OS, tvOS, iOS, iPadOS, and watchOS allows a hacker to modify any files they desire.

The vulnerability of the Crash Reporter component in operating systems such as Mac OS, tvOS, iOS, iPadOS, and watchOS is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to modify arbitrary files...

The vulnerability of the Identity Service in operating systems such as tvOS, iOS, iPadOS, and watchOS allows a hacker to bypass security restrictions.

The vulnerability of the Identity Service for operating systems tvOS, iOS, iPadOS, and watchOS is related to incorrect code generation. Exploiting this vulnerability can allow attackers to circumvent security restrictions...

The vulnerability of Microsoft Edge browser on the iOS operating system, related to bypassing authentication through spoofing, allows attackers to carry out spoofing attacks.

The vulnerability of Microsoft Edge browser on the iOS operating system is related to the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to carry out spoofing attacks remotely...

The vulnerability of the Preferences component in operating systems such as Mac OS, tvOS, iOS, iPadOS, and watchOS allows attackers to increase their privileges.

The vulnerability of the Preferences component in operating systems such as Mac OS, tvOS, iOS, iPadOS, and watchOS is related to deficiencies in path name checking for restricted access directories. Exploiting this vulnerability can allow attackers to gain increased privileges...

A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution

Posted by Ian Beer & Samuel Groß of Google Project Zero We want to thank Citizen Lab for sharing a sample of the FORCEDENTRY exploit with us, and Apple’s Security Engineering and Architecture SEAR group for collaborating with us on the technical analysis. The editorial opinions reflected below ar...