Hackers are actively exploiting three Apple iOS flaws

Apple has released fixes for three vulnerabilities embedded in the core operating systems of its iPhone, iPad and Apple TV products, that have been exploited in the wild.

The three zero-day vulnerabilities found in Apple’s iOS, iPadOS and tvOS have been fixed with iOS 14.4, iPadOS 14.4 and tvOS 14.4, but the firm confirmed the flaws have already been exploited by cyber criminals.

The vulnerability tracked as CVE-2021-1782 paves the way for a malicious application to elevate privileges, and is present in the kernel of all three Apple systems. It has been described as a race condition, which has now been addressed with improved locking. 

Both CVE-2021-1871 and CVE-2021-1870 concern the WebKit browser engine of iPadOS and iOS, and allows attackers to cause arbitrary code execution. These have been described as a logic issue that was addressed with improved restrictions. 

The devices affected include iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, iPod touch (7th generation), as well as Apple TV 4K and Apple TV HD. The company, however, declined to disclose how broad the attack was, or who specifically has been targeted by hackers exploiting these flaws.

The flaws were flagged to Apple by an anonymous researcher, and, unfortunately, no further details have been made available. 

“Apple admitting to iPhone security vulnerabilities is about as rare as someone getting struck by lightning. So kudos for them for releasing iOS 14.4 with patches for the three identified bugs,” said the chief security officer at Cybereason, Sam Curry.

“What we won’t know for some time is how widespread the threat is. That information is reportedly forthcoming. I say to Apple, don’t stop there as transparency is extremely important because you are one of the largest companies in the world and tens of millions of people trust you to get trust right.”

Curry added that Apple should dig deeper into the investigation and come up with new countermeasures and controls.

See the original article here: ITPro