Hackers may have been using a previously unknown iOS vulnerability to infiltrate people’s iPhones with a specially crafted email.
The flaw deals with the official Mail app in iOS. You can actually trigger the software to run rogue computer code when it handles an email that consumes a large amount of RAM, according to cybersecurity firm ZecOps.
What makes the flaw particularly scary is how the specially crafted email can trigger it without any interaction from the user. Instead, the attack will occur in the background as the Mail app loads the email. Hence, ZecOps is dubbing the vulnerability a remote “zero-click” attack.
The company has detected hackers abusing the flaw to target enterprise users, company executives, and other IT cybersecurity firms as far back as January 2018. That said, ZecOps couldn’t definitively confirm the attacks; the emails used to trigger the vulnerability were deleted from victim devices. Instead, the company relied on digital clues left over during the intrusions to reconstruct the attack vector. (In doing so, ZecOps also uncovered another iOS "out-of-bounds write" vulnerability, which the hackers likely triggered by accident.)
ZecOps information bar about the attack.
According to ZecOps, the zero-click attack affects iOS versions going back to iOS 6. However, the vulnerability does have some key limitations: It only works against Apple’s default Mail app, and not against other email apps, like Gmail or Outlook.
The vulnerability also can’t take over your iPhone. Instead, it has to be coupled with another attack to have any chance of hijacking the operating system. Otherwise, the vulnerability alone can do nothing but modify, delete, or leak emails from the Mail app.
The other limitation involves the specially crafted email. ZecOps said it developed a demo of the attack by using an email containing several gigabytes in plaintext — a huge size that exceeds the cap on popular email services such as Gmail and Yahoo Mail. Nevertheless, ZecOps said a hacker can use other tricks to trigger the vulnerability without sending a large email. Your iPhone also doesn't need to download the malicious message in its entirety either.
According to Motherboard, Apple plans on patching the flaw in an upcoming release to iOS. Currently, the fix is only available in the iOS 13.4.5 beta release. “If you cannot patch to this version, make sure to not use the Mail application — and instead to temporarily use Outlook or Gmail,” ZecOps added.
Who might be behind the attacks remains unknown. But ZecOps speculates government-sponsored hackers may have bought details of zero-click vulnerability from a third party. “We are aware that at least one ‘hackers-for-hire’ organization is selling exploits using vulnerabilities that leverage email addresses as a main identifier,” the company said.
Further Reading
- NordVPN: You're Getting a Speed Boost, Thanks to WireGuard Implementation
- Got a Zoom-Bombing Problem? Zoom Will Soon Let You Report Attacks in Real Time
- Gamers Report Unauthorized Access to Their Nintendo Accounts
- Nonprofit Behind Tor Browser Cuts Staff, Citing COVID-19 Impact
- More in Apple
- More in Security