Apple finds "no evidence" hackers exploited critical iOS Mail flaws

The developer pours cold water over ZecOps' claims that businesses have been targeted since January 2018

Apple has denied that three severe flaws in its Mail app for iOS devices have been used to attack iPhone users, suggesting the flaw does “not pose an immediate risk”.

Researchers with ZecOps outlined in detail the mechanism by which two severe flaws in the in-built iOS Mail app had been used to attack individuals since at least January 2018.

Advertisement - Article continues below

The flaws, present in the flagship operating system since at least iOS 6 in 2012, allowed hackers to leak modify or delete emails. On one occasion, they were used in combination with a third unknown vulnerability to give cyber criminals full control of a device.

The alleged targets, identified by the researchers, included MSSPs and individuals from a Fortune 500 company, among other victims, although Apple has found no evidence that its users were attacked.

“We have thoroughly investigated the researcher’s report and, based on the information provided, have concluded these issues do not pose an immediate risk to our users,” Apple said in a statement, according to Reuters

“The researcher identified three issues in Mail, but alone they are insufficient to bypass iPhone and iPad security protections, and we have found no evidence they were used against customers.”

Advertisement
Advertisement - Article continues below

ZecOps has stood by its initial research, however, suggesting in a response that several targets were indeed affected by the vulnerability, which has not yet been officially patched. The firm reported the issue to Apple on 19 February, with the developer issuing fixes in a publicly available iOS beta between 15 and 16 April.

Advertisement - Article continues below

“According to ZecOps data, there were triggers in-the-wild for this vulnerability for a few organisations,” the cyber security company said in response to Apple's statement.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

“We want to thank Apple for working on a patch, and we’re looking forward to updating our devices once it’s available. ZecOps will release more information and POCs once a patch is available.”

To initiate the attack, a hacker would only need to send email messages that consumed significant amounts of memory in order to trigger a buffer overflow. This means the attackers could fill a block of memory beyond its capacity and overwrite areas that hold executable code, with their own malicious code.

The flaws can be exploited in a ‘zero-click’ fashion on iOS 13, meaning no user interaction would be needed, and attackers could trigger the pathways while Mail was running in the background. On iOS 12, by contrast, users would need to click on the malicious email messages received, unless the cyber criminals also controlled the email server.

All iOS versions are vulnerable, including iOS 13.4.1, although the researchers haven’t been able to test the Mail app on versions prior to iOS 6. MacOS is not vulnerable to either flaw.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now
Advertisement

Most Popular

Visit/security/34616/the-top-ten-password-cracking-techniques-used-by-hackers
Security

The top ten password-cracking techniques used by hackers

5 May 2020
Visit/mobile/5g/355712/nokia-5g-speed-record
5G

Nokia breaks 5G record with speeds nearing 5Gbps

20 May 2020
Visit/cloud/cloud-computing/355742/microsoft-launches-public-cloud-service-for-health-care
cloud computing

Microsoft launches public cloud service for health care

21 May 2020