Google’s elite hacking team reveals an untimely bug in the iPhone

-

On the same day Apple Inc. revealed the date for its latest iPhone event, Google’s privacy team said it had discovered a two-year long vulnerability in the phone-maker’s software.

The bug targeted a small number of websites. Simply visiting those pages could have left iPhone users susceptible to the breach and possibly affected thousands of users per week, Google Zero wrote in a number of blog posts on Thursday.

Visiting the unnamed sites allowed hackers to gain access to a plethora of information, including the ability to track movements via the phone’s GPS system, to obtaining passwords and being privy to sensitive conversations through iMessage and WhatsApp.

The report from Google came at the same time Apple announced the date for unveiling its next iPhones, and potentially a slew of other products. Earlier in August Apple’s top security engineer said the company would begin distributing special iPhones to researchers to help them discover flaws before malicious hackers do.

The bug-hunting hackers at Google reported the issue to Apple on Feb. 1 and, less than a week later, Apple updated its operating systems. Apple did not return a request for comment.

Google’s Project Zero is an elite unit of Alphabet Inc.’s Google, made up of cybersleuths who hunt for “zero day” vulnerabilities⁠—unintended design flaws that can be exploited by hackers to break into computer systems.

“All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly,” Ian Beer, a Project Zero researcher, wrote in a blog post. “Treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them.”

Beer said attackers exploited fourteen different software flaws, including seven which targeted Safari, the Apple product’s built-in web browser. Through developing five distinct entry points, the cybercriminals could access various features on the phone, including those usually off-limits to users. This meant hackers could quietly install malware onto the device without the owner knowing.

A brightside is the bug isn’t persistent. Simply rebooting the device will wipe it clear, unless it is at risk again. However, Beer said hackers could continue having access to accounts they had passwords for even after they lost the ability to get new information from the phone.

⁠—Bloomberg News



from CommaFeed - Real Time Trends Network https://ift.tt/2ZAUivb
via IFTTT

Comments

Post a Comment

Popular posts from this blog

Takeaways from the outcry over Dior’s Johnny Depp perfume ad: Tuesday Wake-Up Call

-
Welcome to Ad Age’s Wake-Up Call, our daily roundup of advertising, marketing, media and digital news. You can sign up to get an audio version of this briefing on your Alexa device. Dior pulls a perfume ad starring Johnny Depp Yet another luxury brand just had to backtrack after a culturally insensitive move. Dior on Friday pulled an ad for its “Sauvage” perfume, as Business of Fashion reports ; the spot starred Johnny Depp playing guitar in the desert while a Native American dancer, Canku One Star, performed in traditional dress. The company portrayed the spot as “an authentic journey deep into the Native American soul.” But the brand was quickly accused of cultural appropriation. Critics seemed most troubled by the juxtaposition of Native American imagery with the word "Sauvage"—which means “wild” in French, but which also evokes the history of labeling indigenous groups as “savages.”  LVMH-owned Parfums Christian Dior had apparently tried to proceed cautiously. It coo
Read more

When the coronavirus infodemic strikes

-
Image
Social media sites are stepping up their efforts in the war against misinformation… specifically, the coronavirus/COVID-19 infodemic . There’s a seemingly endless stream of potentially dangerous misinformation flying around online related to the COVID-19 pandemic, and that could have fatal results. It’s boomtown in fake-news land riding high on the wave of people being left with their tech devices 24/7. I myself regularly see everything posted online from “hand gel is an immunizer” (nope) and “children can’t be affected” (not true) to “UK rules mean domestic abuse survivors have to stay with their abusive spouse” (absolutely not true at all and hugely dangerous to claim).  We even have engineers being spat on thanks to 5G conspiracy theories potentially resulting in transmission of coronavirus . Turns out a global pandemic is a lightning rod for pushing people to conspiracy theories galore, to the extent that some folks have to go hunting for guides to wean their family members a
Read more

Patch, Or Your Solid State Drives Roll Over And Die

-
Image
Expiration dates for computer drives? That’s what a line of HP solid-state drives are facing as the variable for their uptime counter is running out. When it does, the drive “expires” and, well, no more data storage for you! There are a series of stages in the evolution of a software developer as they master their art, and one of those stages comes in understanding that while they may have a handle on the abstracted world presented by their development environment they perhaps haven’t considered the moments in which the real computer that lives behind it intrudes. Think of the first time you saw an SQL injection attack on a website, for example, or the moment you realised that a variable type is linked to the physical constraints of the number of memory locations it has reserved for it. So people who write software surround themselves with an armoury of things they watch out for as they code, and thus endeavour to produce software less likely to break. Firmly in that arena is the size
Read more