Apple on Friday pushed out a major iOS security update to fix a pair of zero-day vulnerabilities already being exploited in the wild. The newest iOS 16.4.1 and iPadOS 16.4.1 updates cover code execution software flaws in IOSurfaceAccelerator and WebKit, suggesting a complex exploit chain was detected in the wild hitting the latest iPhone devices. The advisory documents two separate issues — CVE-2023-28205 and CVE-2023-28206 — that expose iPhones and iPads to arbitrary code execution attacks. Apple described the IOSurfaceAccelerator flaw as an out-of-bounds write issue that was addressed with improved input validation. The WebKit bug, which has already been exploited via web content to execute arbitrary code with kernel privileges, has been fixed with improved memory management.
The patch comes alongside news from Google that commercial spyware vendors are burning through zero-days to infect mobile devices with surveillance malware. In one of the two campaigns described by Google this week, an attack started with a link being sent to the targeted user via SMS. When clicked, the link took the victim to malicious websites delivering Android or iOS exploits — depending on the target’s device. Once the exploits were delivered, victims were redirected to legitimate websites, likely in an effort to avoid raising suspicion.
Apple did not say if the newly discovered exploits are capable of bypassing the Lockdown Mode feature that Apple shipped to deter these types of attacks. So far this year, there have been at least 24 documented zero-day vulnerabilities exploited in the wild prior to discovery.
The discovery of the iOS and Android zero-day exploits highlights the importance of keeping devices updated with the latest security patches and the potential risks of using unpatched mobile devices. It is also a good reminder that users should be cautious of the links they click on, as they may lead to malicious websites.
In conclusion, Apple released a major iOS security update to fix a pair of zero-day vulnerabilities already being exploited in the wild. Apple did not say if the newly discovered exploits are capable of bypassing the Lockdown Mode feature that was shipped to deter these types of attacks. The discovery of the iOS and Android zero-day exploits highlights the importance of keeping devices updated with the latest security patches and the potential risks of using unpatched mobile devices.
Key Points:
• Apple released a major iOS security update to fix two zero-day vulnerabilities already being exploited in the wild.
• The patch covers code execution software flaws in IOSurfaceAccelerator and WebKit.
• Google has revealed that commercial spyware vendors are burning through zero-days to infect mobile devices with surveillance malware.
• The discovery of the iOS and Android zero-day exploits highlights the importance of keeping devices updated with the latest security patches.
• Users should also be cautious of the links they click on, as they may lead to malicious websites.