• Office Hours : 08:00 - 17:30

Hackers are actively exploiting three Apple iOS flaws

Apple has released fixes for three vulnerabilities embedded in the core operating systems of its iPhone, iPad and Apple TV products, that have been exploited in the wild.

The three zero-day vulnerabilities found in Apple’s iOS, iPadOS and tvOS have been fixed with iOS 14.4, iPadOS 14.4 and tvOS 14.4, but the firm confirmed the flaws have already been exploited by cyber criminals.

The vulnerability tracked as CVE-2021-1782 paves the way for a malicious application to elevate privileges, and is present in the kernel of all three Apple systems. It has been described as a race condition, which has now been addressed with improved locking. 

Both CVE-2021-1871 and CVE-2021-1870 concern the WebKit browser engine of iPadOS and iOS, and allows attackers to cause arbitrary code execution. These have been described as a logic issue that was addressed with improved restrictions. 

The devices affected include iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, iPod touch (7th generation), as well as Apple TV 4K and Apple TV HD. The company, however, declined to disclose how broad the attack was, or who specifically has been targeted by hackers exploiting these flaws.

The flaws were flagged to Apple by an anonymous researcher, and, unfortunately, no further details have been made available. 

Related Resource

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

“Apple admitting to iPhone security vulnerabilities is about as rare as someone getting struck by lightning. So kudos for them for releasing iOS 14.4 with patches for the three identified bugs,” said the chief security officer at Cybereason, Sam Curry.

“What we won’t know for some time is how widespread the threat is. That information is reportedly forthcoming. I say to Apple, don’t stop there as transparency is extremely important because you are one of the largest companies in the world and tens of millions of people trust you to get trust right.”

Curry added that Apple should dig deeper into the investigation and come up with new countermeasures and controls.

Featured Resources

How to be an MSP: Seven steps to success

Building your business from the ground up

Download now

HCI 2.0 From HPE: How it can help your business thrive

Why SMBs need to accelerate digital transformation with HCI

Download now

Cost of a data breach report 2020

Find out what factors help mitigate breach costs

Download now

Can you benefit from running your SAP HANA platform on IBM Power Systems?

Top challenges and benefits of SAP HANA

Download now

See the original article here: ITPro