Indian iPhone Spy Campaign Used Fake MDM Platform

Cyberattackers have used a bogus mobile device management MDM system to target a small – but presumably high-value – set of iPhones in India, in a cyberespionage campaign that has some unusual hallmarks. Researchers said Thursday that attackers deployed an open-source MDM – which is typically use...

Hackers Used Malicious MDM Solution to Spy On 'Highly Targeted' iPhone Users

Security researchers have uncovered a "highly targeted" mobile malware campaign that has been operating since August 2015 and found spying on 13 selected iPhones in India. The attackers, who are also believed to be operating from India, were found abusing mobile device management MDM protocol—a...

Hackers Used Malicious MDM Solution to Spy On 'Highly Targeted' iPhone Users

Security researchers have uncovered a "highly targeted" mobile malware campaign that has been operating since August 2015 and found spying on 13 selected iPhones in India. The attackers, who are also believed to be operating from India, were found abusing mobile device management MDM protocol—a...

Researchers Reveal Workaround for Apple’s USB Restricted Mode

Just as Apple rolled out its new USB Restricted Mode security feature in an OS update, Monday, researchers said that they have already found a workaround. USB Restricted Mode, released as part of iOS 11.4.1, had removed an iPhone USB access feature, so that an hour after the iPhone has been locke...

USB Accessory Can Defeat iOS's New "USB Restricted Mode" Security Feature

With the release of iOS 11.4.1, Apple has finally rolled out a new security feature designed to protect your devices against USB accessories that connect to the data port, making it harder for law enforcement and hackers to break into your iPhone or iPad without your permission. Dubbed USB...

Apple OS Update Lifts Curtain on iPhone USB Restricted Mode

Apple has officially added a controversial security feature, USB Restricted Mode, to iPhones as part of its new iOS 11.4.1, released on Monday. The feature removes the infamous iPhone USB access feature, blocking out hackers – but also potentially law enforcement – from accessing a locked phone’s...

Bypassing Passcodes in iOS

Last week, a story was going around explaining how to brute-force an iOS password. Basically, the trick was to plug the phone into an external keyboard and trying every PIN at once: We reported Friday on Hickey's findings, which claimed to be able to send all combinations of a user's possible...

ANA App for iOS fails to validate SSL server certificate vulnerability

ANA App is an APP application. ANA App for iOS is vulnerable to a method-validated SSL server certificate vulnerability that could be exploited by an attacker to obtain and/or alter the content of a communication...

New iPhone OS May Include Device-Unlocking Security

iOS 12, the next release of Apple's iPhone operating system, may include features to prevent someone from unlocking your phone without your permission: The feature essentially forces users to unlock the iPhone with the passcode when connecting it to a USB accessory everytime the phone has not bee...

DEBIAN-CVE-2018-4233

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit"...

CVE-2018-4235

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Messages" component. It allows local users to perform impersonation attacks via an unspecified...

CVE-2018-4224

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Security...

CVE-2018-4202

An issue was discovered in certain Apple products. iOS before 11.4 is affected. macOS before 10.13.5 is affected. The issue involves the "iBooks" component. It allows man-in-the-middle attackers to spoof a password prompt...

Apple will let users run iOS apps on macOS

Apple is making it easier for mobile developers to port their iOS apps to the next-generation macOS Mojave desktop platform—a major step in bringing the two platforms closer together. However, at the same time, the company straightforward denied the idea of merging the iPhone and Mac operating...

Apple iOS inkPresentation UI fraud vulnerability

Apple iOS is an operating system developed by Apple for its mobile devices.LinkPresentation is one of the presentation display components. A security vulnerability exists in the handling of URLs in the linkPresentation component in Apple iOS versions prior to 11.3.1. The vulnerability can be...

Input validation vulnerability in multiple Apple products

Apple iOS, macOS High Sierra, tvOS, and watchOS are products of Apple Inc. Apple iOS is a suite of operating systems for mobile devices; macOS High Sierra is a specialized operating system for Mac computers; tvOS is a smart TV operating system; and watchOS is a smart watch operating system.Messag...

Apple iOS Siri Permissions Vulnerability (CNVD-2018-12171)

Apple iOS is an operating system developed by Apple Inc. for mobile devices.Siri is an intelligent voice control component.Siri Contacts is the component of Siri that is used to access private contact information.Siri Contacts is the component of Siri that is used to access private contact...

Instagram story spam claims free Apple Watch

I have to admit, I'm not 100 percent sure who Elton Castee is. "Who's that?" you ask? Digging around revealed that he's big on YouTube, has done some films, and raises money for dogs, which is very cool. He's also popular on Instagram, with 400k+ followers. With that in mind, we've seen a few...

Brave Software: DoS in Brave browser for iOS

Summary: Attacker could initiate DoS during page loading. Products affected: 1.6 18.05.17.13 Device iPhone 6s iOS 11.3.1 Steps To Reproduce: PoC: html let o = document.body.appendChilddocument.createElement'object'; // application/json or application/pdf are valid values too o.type = 'text/html' ...

A week in security (May 14 – May 20)

Last week, we looked at the deluge of incoming policies caused by GDPR, tackled Adobe Reader zero days, and ran through some iPhone security tips. We also caught some helpline scammers in the act, explored advergaming, got our Senate Bill game face on, and deep dived into Drupal vulnerabilities...