←back to thread

Apple Confirms Zero-Day Attacks Hitting macOS Systems

(www.securityweek.com)
265 points fortran77 | 2 comments | 20 Nov 24 00:26 UTC | HN request time: 0.414s | source
Show context
TekMol ◴[20 Nov 24 07:13 UTC] No.42191458[source]▶
The article sounds like it also applies to iOS

    The company urged users across the Apple
    ecosystem to apply the urgent iOS 18.1.1,
    macOS Sequoia 15.1.1 and the older iOS 17.7.2.
And that it is web based

    maliciously crafted web content may lead
    to arbitrary code execution
Has this happened before? That iPhones had a security hole that could be exploited over the web?
replies(5): >>42191532 #>>42191533 #>>42191570 #>>42191597 #>>42192845 #
e28eta ◴[20 Nov 24 07:25 UTC] No.42191532[source]▶
Absolutely. I don’t follow the scene, but early in the iphone’s product life I distinctly remember a web-based jailbreak, where you loaded a page and then you could ‘slide to jailbreak’. I don’t know if user action was strictly required, or if it was a UX thing.
replies(1): >>42192094 #
TekMol ◴[20 Nov 24 09:16 UTC] No.42192094[source]▶
Shouldn't that lead to a massive amount of iPhones being broken into?

If not, why?

If so, what happened to all those phones?

I never hear stories like "My iPhone was broken into and this happened: ..."

replies(4): >>42192219 #>>42192481 #>>42192531 #>>42192745 #
phillypham ◴[20 Nov 24 10:20 UTC] No.42192481[source]▶
It used to be possible to break into iPhones by sending just a text message without the target clicking on anything.

The only thing that kept this under control was there was an agreement to not target US-based numbers and the exploit was expensive.

Reference: The Battle for the World’s Most Powerful Cyberweapon https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... and https://en.wikipedia.org/wiki/Pegasus_(spyware)

replies(1): >>42192761 #
1. pwagland ◴[20 Nov 24 11:08 UTC] No.42192761[source]▶
Not quite, from the Wikipedia:

> Pegasus' iOS exploitation was identified in August 2016. Emirati human rights defender Ahmed Mansoor received a text message promising "secrets" about torture happening in prisons in the United Arab Emirates by following a link. Mansoor sent the link to Citizen Lab of the University of Toronto, which investigated, with the collaboration of Lookout, finding that if Mansoor had followed the link it would have jailbroken his phone and implanted the spyware into it, in a form of social engineering.

So the link was sent via text message, but you had to click on it. Receiving the text message did nothing in and of itself.

replies(1): >>42192930 #
2. phillypham ◴[20 Nov 24 11:38 UTC] No.42192930[source]▶
Initial versions were one-click. The attack became more sophisticated and became zero-click.

See https://en.wikipedia.org/wiki/Pegasus_(spyware)#Development_... for timeline.

See https://en.wikipedia.org/wiki/Pegasus_(spyware)#Saudi_Arabia for the iMessage version.