04/26 Update below. This post was originally published on April 23
Apple has already released the best iPhone of 2020, but now millions of iPhone owners - both old and new - need to be careful because the company has just confirmed a massive iOS security hole which impacts almost every iPhone on the planet.
A serious new iOS exploit impacts almost every iPhone and it has been running for years.
Following the publication of a devastating report from security firm ZecOps (covered here by Forbes), which claimed that every iPhone running a version of iOS 6 or newer is vulnerable to remote attacks, Apple has now confirmed the problem is real.
04/25 Update: Apple has now gone a step further in talking about this security breach and it has met a controversial response. In an official statement, the company played down ZecOps' findings, saying: "Apple takes all reports of security threats seriously. We have thoroughly investigated the researcher's report and, based on the information provided, have concluded these issues do not pose an immediate risk to our users. The researcher identified three issues in Mail, but alone they are insufficient to bypass iPhone and iPad security protections, and we have found no evidence they were used against customers. These potential issues will be addressed in a software update soon. We value our collaboration with security researchers to help keep our users safe and will be crediting the researcher for their assistance."
In response, ZecOps has stood by its report and issued its own response disputing Apple's statement. It wrote: "According to ZecOps data, there were triggers in-the-wild for this vulnerability on a few organizations. We want to thank Apple for working on a patch, and we’re looking forward to updating our devices once it’s available. ZecOps will release more information and POCs once a patch is available." This additional information will make for fascinating reading once iOS 13.4.5 is released. This story seems to be far from over.
04/26 Update: In an exclusive interview with me, ZecOps CEO Zuk Avraham has pushed back against Apple's statement downplaying the iOS Mail vulnerability in iPhones. Avraham states these are critical points Apple must address with regards to the discovery:
1. How many triggers were there for this vulnerability (both malicious and non malicious) since iOS 6?
2. How has Apple confirmed that all of these triggers are not malicious?
3. Following previous evidence of remote attacks happening in the wild on iOS users in multiple cases (Pegasus, Google TAG discovery, etc). Is Apple planning to improve forensics information so people will be able to analyze their devices more accurately and continuously (without physical connection to the device) ?
Given the remarkably wide potential impact of this iOS vulnerability, I put these questions directly to Apple but the company has declined to comment on them saying it is "not adding anything beyond the statement at this point." Despite this silence, I expect Apple to accelerate up the next iOS 13 release and would not be surprised if an update arrives early next week, now the vulnerability is in the open. The bigger question, however, is whether Apple will patch older iPhones which do not support iOS 13. I expect pressure will mount for the company to do so.
So what are we dealing with? What ZecOps discovered is a serious vulnerability in Apple’s iOS Mail app which allows an attacker to remotely infect an iPhone and gain control over their inbox. In addition, not only did ZecOps find that the attacks can happen without an iPhone owner’s knowledge but triggers have been happening for more than two years, with the first trigger subsequently detected back in January 2018.
And there’s a further kicker: ZecOps found that the attacks are easier to perform on iOS 13 than previous generations of iOS. For example, ZecOps explains that with iOS 12, an attacker requires the iPhone user to open a malicious email. But with iOS 13, it can be triggered unassisted simply from the Mail app being opened in the background.
ZecOps has issued this infographic highlighting the massive iOS iPhone vulnerability
The good news? Apple has confirmed to Vice that it has managed to patch the vulnerability in the latest iOS 13.4.5 beta and it looks like the company will now accelerate its release (with iOS 13.4.1 the previous update, it appears that Apple will now be skipping some digits unless it pushes out a dedicated iOS 13.4.2 release instead).
Until then, ZecOps states that there are two ways to stay safe: disable the Mail app (Apple has a guide here) and use a third-party app instead. Notably, it found both Outlook and Gmail are not vulnerable to the exploit so there’s no need to bury your iPhone in a box and drop it in the sea.
That said, none of this hides the fact that a serious vulnerability running through eight iOS generations (iOS 6 was released in September 2012) is eye-opening. It also means that almost every iPhone in use today (Apple claims 1.5 billion active devices of which iPhones make up the majority) is impacted. This is because iOS 6 was released for all iPhones other than the original (released 2007) and it’s successor, the iPhone 3G.
Watch this space, because I expect Apple to move quickly on this.
___
Follow Gordon on Facebook
More On Forbes
Apple iPhone 12: Everything We Know So Far
