Apple Mail on iOS has two severe "zero-click" flaws

The eight-year-old vulnerabilities can be triggered by cyber criminals on iOS 13 without any user action

The Mail app on Apple’s flagship iOS operating system has been afflicted with two serious vulnerabilities that can allow a hacker to attack a device by sending emails that consume significant levels of memory.

Hackers have triggered two vulnerabilities in the Mail app, which have existed since iOS 6 was released in 2012, giving them the power to leak, modify or delete emails, according to findings by ZecOps. In addition, the flaws have been exploited in combination with another as-of-yet unidentified bug to gain full device access.

Advertisement - Article continues below

To initiate the attack, one would send an email message designed to cause a buffer overflow in the Mail app, which means the hacker can fill a block of memory beyond its capacity. These content of these emails, once sent, can then be deleted.

The receipt of an email triggers the code paths for both vulnerabilities, the first known as OOB Write and the second dubbed Remote Heap Overflow. When exploited in the wild, ZecOps researchers believe the OOB Write flaw was accidentally triggered while hackers were aiming to trigger the Remote Heap Overflow.

All iOS versions are vulnerable, including the Mail app on iOS 13.4.1, although the researchers haven’t been able to test versions prior to iOS 6. MacOS is not vulnerable to either flaw.

Advertisement - Article continues below

The vulnerability can be triggered remotely on iOS 13 when the Mail application is opened in the background. For iPhone users still on iOS 12, meanwhile, the attack requires a click on the email. If the hacker controls the email server, however, the attack can be triggered in a zero-click fashion in a similar way to how it’d be conducted on devices running iOS 13. 

Advertisement - Article continues below

Researchers have identified several targets as having been attacked using the mechanism, including individuals from a Fortune 500 business in the US, a European journalist, and MSSPs from Saudi Arabia and Israel.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

ZecOps began tracking the attacks being triggered from January 2018 on a device running iOS 11.2.2, with the same threat operators likely abusing the vulnerabilities now. It’s possible, moreover, that the attackers were using the vulnerabilities even earlier.

Following a routine iOS security probe, researchers found a number of suspicious events affecting the default Mail app. Following analysis, ZecOps discovered the exploitable vulnerability affecting iPhones and iPads, as well as multiple triggers in the wild, with targets including enterprise users, VIPs, and MSSPs over a prolonged period of time.

ZecOps reported the issue to Apple on 19 February, with the developer patching both flaws in a publicly available beta between 15 and 16 April. 

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now


Mobile Phones

Apple’s iOS 13.5 update targets coronavirus-related iPhone issues

22 May 2020
Mobile Phones

Apple reportedly delaying iPhone 12 launch until October

21 May 2020
mobile security

FBI and Justice Department accuse Apple of stalling terrorist probe

19 May 2020

Apple MacBook Pro 13in (2018) review: Perfection, redefined

18 May 2020

Most Popular

Microsoft Windows

Microsoft warns users not to install Windows 10's May update

28 May 2020
data breaches

EasyJet faces class-action lawsuit over data breach

26 May 2020
cyber security

Microsoft bans Trend Micro driver from Windows 10 for "cheating" hardware tests

27 May 2020