Apple Mail on iOS has two severe "zero-click" flaws

The eight-year-old vulnerabilities can be triggered by cyber criminals on iOS 13 without any user action

The Mail app on Apple’s flagship iOS operating system has been afflicted with two serious vulnerabilities that can allow a hacker to attack a device by sending emails that consume significant levels of memory.

Hackers have triggered two vulnerabilities in the Mail app, which have existed since iOS 6 was released in 2012, giving them the power to leak, modify or delete emails, according to findings by ZecOps. In addition, the flaws have been exploited in combination with another as-of-yet unidentified bug to gain full device access.

To initiate the attack, one would send an email message designed to cause a buffer overflow in the Mail app, which means the hacker can fill a block of memory beyond its capacity. These content of these emails, once sent, can then be deleted.

The receipt of an email triggers the code paths for both vulnerabilities, the first known as OOB Write and the second dubbed Remote Heap Overflow. When exploited in the wild, ZecOps researchers believe the OOB Write flaw was accidentally triggered while hackers were aiming to trigger the Remote Heap Overflow.

All iOS versions are vulnerable, including the Mail app on iOS 13.4.1, although the researchers haven’t been able to test versions prior to iOS 6. MacOS is not vulnerable to either flaw.

The vulnerability can be triggered remotely on iOS 13 when the Mail application is opened in the background. For iPhone users still on iOS 12, meanwhile, the attack requires a click on the email. If the hacker controls the email server, however, the attack can be triggered in a zero-click fashion in a similar way to how it’d be conducted on devices running iOS 13. 

Researchers have identified several targets as having been attacked using the mechanism, including individuals from a Fortune 500 business in the US, a European journalist, and MSSPs from Saudi Arabia and Israel.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

ZecOps began tracking the attacks being triggered from January 2018 on a device running iOS 11.2.2, with the same threat operators likely abusing the vulnerabilities now. It’s possible, moreover, that the attackers were using the vulnerabilities even earlier.

Following a routine iOS security probe, researchers found a number of suspicious events affecting the default Mail app. Following analysis, ZecOps discovered the exploitable vulnerability affecting iPhones and iPads, as well as multiple triggers in the wild, with targets including enterprise users, VIPs, and MSSPs over a prolonged period of time.

ZecOps reported the issue to Apple on 19 February, with the developer patching both flaws in a publicly available beta between 15 and 16 April. 

Featured Resources

Preparing for AI-enabled cyber attacks

MIT technology review insights

Download now

Cloud storage performance analysis

Storage performance and value of the IONOS cloud Compute Engine

Download now

The Forrester Wave: Top security analytics platforms

The 11 providers that matter most and how they stack up

Download now

Harness data to reinvent your organisation

Build a data strategy for the next wave of cloud innovation

Download now

Recommended

Senate report slams agencies for poor cyber security
cyber security

Senate report slams agencies for poor cyber security

3 Aug 2021
Most employees put their workplace at risk by taking cyber security shortcuts
cyber security

Most employees put their workplace at risk by taking cyber security shortcuts

27 Jul 2021
Apple reportedly planning all-5G iPhone lineup for 2022
Hardware

Apple reportedly planning all-5G iPhone lineup for 2022

21 Jul 2021
Apple reportedly delays return to the office amid rising COVID cases
Careers & training

Apple reportedly delays return to the office amid rising COVID cases

20 Jul 2021

Most Popular

UK gov considers blocking Nvidia's takeover of Arm
Acquisition

UK gov considers blocking Nvidia's takeover of Arm

4 Aug 2021
RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Preparing for AI-enabled cyber attacks
Whitepaper

Preparing for AI-enabled cyber attacks

22 Jul 2021