On Sat, 31 Aug 2019 22:43:38 -0000 (UTC), Arlen G. Holder wrote:
> Don't ever trust anything that Apple says in their release notes
More proof Apple (brilliantly) downplayed the severity of iOS flaws
which lasted for two years and which covered every level of the operating
system, according to Wired today...
Proving Apple severely downplayed (aka lied) in the release notes is
information summarized in this Wired article explanation, where Mac
researchers call the extensive iOS flaws "chilling", while Apple downplays
the 14 severe flaws at all levels as merely "
"The hackers still made some strangely amateurish mistakes, Williams
mentions, making it all the more extraordinary that they operated so long
without being detected."
"chains of code took advantage of a total of 14 security flaws,
targeting everything from the browser's 'sandbox' isolation mechanism to
the core of the operating system known as the kernel, ultimately gaining
complete control over the phone.
They were also used anything but sparingly. Google's researchers say the
malicious sites were programmed to assess devices that loaded them, and to
compromise them with powerful monitoring malware if possible. Almost every
version of iOS 10 through iOS 12 was potentially vulnerable. The sites were
active since at least 2017"
"This is terrifying," says Thomas Reed, a Mac and mobile malware research
specialist at the security firm Malwarebytes....The idea that someone was
[easily] infecting all iPhones that visited certain sites is chilling."
"The attack is notable not just for its breadth, but for the depth of
information it could glean from a victim iPhone. Once installed, it could
monitor live location data, or be used to grab photos, contacts, and even
passwords and other sensitive information from the iOS Keychain.
With such deep system access, the attackers could also potentially read or
listen to communications sent through encrypted messaging services, like
WhatsApp, iMessage, or Signal. The malware doesn't break the underlying
encryption, but these programs still decrypt data on the sender and
receiver's devices. Attackers may have even grabbed access tokens that can
be used to log into services like social media and communication accounts.
Reed says that victim iPhone users would probably have had no indication
that their devices were infected."
"If a hacking operation is brazen enough to indiscriminately hack thousands
of phones, iPhone hacking isn't all that expensive, according to Cooper
Quintin, a security researcher with the Electronic Frontier Foundation's
Threat Lab."
"Regardless of who may be behind it, the mass undetected hacking of
thousands of iPhones should be a wake-up call to the security industryĄXand
particularly anyone who has dismissed iOS hacking as an outlier phenomenon,
unlikely to affect anyone whose secrets aren't worth $1 million."
iOS is basically an untested diarrhea of releases
o The sheer frequency of the releases makes its user base _feel_ safe