Apple Confirms Zero-Day Attacks Hitting macOS Systems

The article sounds like it also applies to iOS

    The company urged users across the Apple
    ecosystem to apply the urgent iOS 18.1.1,
    macOS Sequoia 15.1.1 and the older iOS 17.7.2.

And that it is web based

    maliciously crafted web content may lead
    to arbitrary code execution

Has this happened before? That iPhones had a security hole that could be exploited over the web?

Absolutely. I don’t follow the scene, but early in the iphone’s product life I distinctly remember a web-based jailbreak, where you loaded a page and then you could ‘slide to jailbreak’. I don’t know if user action was strictly required, or if it was a UX thing.

Shouldn't that lead to a massive amount of iPhones being broken into?

If not, why?

If so, what happened to all those phones?

I never hear stories like "My iPhone was broken into and this happened: ..."

It used to be possible to break into iPhones by sending just a text message without the target clicking on anything.

The only thing that kept this under control was there was an agreement to not target US-based numbers and the exploit was expensive.

Reference: The Battle for the World’s Most Powerful Cyberweapon https://www.nytimes.com/2022/01/28/magazine/nso-group-israel... and https://en.wikipedia.org/wiki/Pegasus_(spyware)

Not quite, from the Wikipedia:

> Pegasus' iOS exploitation was identified in August 2016. Emirati human rights defender Ahmed Mansoor received a text message promising "secrets" about torture happening in prisons in the United Arab Emirates by following a link. Mansoor sent the link to Citizen Lab of the University of Toronto, which investigated, with the collaboration of Lookout, finding that if Mansoor had followed the link it would have jailbroken his phone and implanted the spyware into it, in a form of social engineering.

So the link was sent via text message, but you had to click on it. Receiving the text message did nothing in and of itself.