Google Researchers Pinpoint Security Flaw in iPhones
Researchers at Google’s Project Zero announced recently that they discovered an ‘unprecedented’ hacking enterprise targeting iPhone users, which led to thousands of users a week being affected by the issue. The attack was a result of iPhone users visiting certain suspect websites. Once there, the users were infected with a type of malware that gave hackers access to supposedly secure information such as WhatsApp messages and iMessage. In addition to message history, the breach also allowed malicious users to get the location history of the device, address books, Gmail databases, and keychains which the machine uses to manage passwords to multiple different accounts.
While Apple was prompt in patching the problems, with a fix being sent out less than a week after Project Zero informed the company of the problem, it may be a case of too little too late. Some members of Project Zero note that because of the massive breadth of information taken, hackers could maintain persistent access to multiple accounts and services. Authentication tokens stolen from devices could be used to user verification long after the hack had occurred.
Were All iPhones Affected?
While it is advised that users maintain their devices to be completely up-to-date firmware and software, the malware was surprisingly vicious on even updated models. Because of how the malware was designed, users didn’t need to interact with the website for the malware to gain access to the device. Once the user visited the site, maybe being redirected through it in the course of regular browsing, the device would be compromised. While not all iPhones were affected, a significant amount fell prey to the malware attacks.
What Steps can be Taken?
Apple devices no longer hold the title of ‘unhackable’ as they did in the 90s, and users need to be aware of the potential problems that data breaches like these may cause. Installing and maintaining VPNs or password managers are a good start, but malware along these lines is difficult to deal with, especially with the speed at which it compromises a device. Mass exploitation still exists, and users need to remain vigilant, or else they risk falling prey to their own curiosity.
