San Francisco, April 23, 2020-
Security researchers at cybersecurity company ZecOps have discovered two vulnerabilities which they believe are widely exploited in the wild to target iPhone and iPad users.
The researchers discovered the bugs in the default iOS and iPadOS Mail app. The bugs allow to run remote code in the context of MobileMail (iOS 12) or maild (iOS 13).
Successful exploitation of this vulnerability would allow the attacker to leak, modify, and delete emails.
“Additional kernel vulnerability would provide full device access — we suspect that these attackers had another vulnerability. It is currently under investigation,” the San Francisco-based ZecOps said on Wednesday.
What is more, on iOS 13, end users do not require to perform any action for the exploitation to succeed. On iOS 12, the bug requires the victim to click on an email.
If an attacker controls the mail server, the attack can be performed without any clicks on iOS 12 too, the researchers said.
Once the vulnerabilities are triggered or exploited, users should not observe any anomalous behaviour besides a temporary slowdown of mobile mail application, the researcher said.
ALSO READ:
Apple finds ‘no evidence’ that Mail bug used to exploit iPhone, iPad users
ALSO READ:
Google detects 18 million malware, phishing Gmail posts on Coronavirus
ALSO READ:
Why 47,000 Microsoft developers are generating 30,000 bugs a month
When the exploit fails on iOS 12 — users may notice a sudden crash of the Mail application.
On iOS13, besides a temporary slowdown, it would not be noticeable. Failed attacks would not be noticeable on iOS 13 if another attack is carried afterwards and deletes the email, they added.
“With very limited data we were able to see that at least six organisations were impacted by this vulnerability – and the potential abuse of this vulnerability is enormous,” ZecOps said in a blog post .
iOS is vulnerable to these bugs at least since iOS 6 –September 2012, ZecOps said, adding that it did not check earlier versions.
MacOS is not vulnerable to these bugs, it added.
Following the discovery of the vulnerabilities, ZecOps said it alerted Apple in February.
Apple has patched both the bugs in the latest beta releases of iOS 13, while a fix is set to arrive in the next publicly available iOS update in iOS and iPadOS 13.4.5, reports AppleInsider.
“The newly released beta update of 13.4.5 contains a patch for these vulnerabilities. If you cannot patch to this version instead of using Mail application consider to use other mail applications until a GA patch is available,” ZecOps said. (Agency)
For YesPunjab updates on TELEGRAM, download TELEGRAM and CLICK HERE TO SUBSCRIBE
