Google Project Zero, a group that examines and publishes security and privacy exploits it detects in public software, said on Thursday that there were huge security holes in iPhone software that existed for two years. The exploits gave attackers access to photos, location information, private messages, and more.
Apple has recently emphasised iPhone privacy with a big marketing campaign. At CES 2019, just across from the main conference centre that was plastered with Google Assistant logos, Apple posted an ad that read: “What happens on your iPhone, stays on your iPhone.” The company has also run commercials touting the privacy features of the iPhone.
The flaws were fixed in February when Apple released iOS 12.1.4 after Google notified the company, which is why Google is now talking about the flaws publicly. But Google said the attack could be used against iPhone owners who visited a “small collection of hacked websites” and could have affected “thousands of visitors per week.”
According to the Project Zero’s Threat Analysis Group, there were 14 different exploits that hackers were using to take private information from iPhones. “Seven for the iPhone’s web browser, five for the kernel and two separate sandbox escapes,” the group said.
Google said it wasn’t targeted at specific people, all you had to do was visit an infected site.
One flaw let attackers gain access to private messages. “The implant has access to all the database files (on the victim’s phone) used by popular end-to-end encryption apps like WhatsApp, Telegram and iMessage,” TAG explained, noting that the attackers could get database files with “unencrypted, plain-text of the messages sent and received using the apps.”
Attacks could also give hackers access to contacts, Gmail messages, photos, and real-time location information, the group said, noting that attackers could also install apps.
“The implant has access to almost all of the personal information available on the device, which it is able to upload, unencrypted, to the attacker’s server,” TAG explained. “The implant binary does not persist on the device; if the phone is rebooted then the implant will not run until the device is re-exploited when the user visits a compromised site again. Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device.”
The flaws are fixed now, but Google said that “for this one campaign that we’ve seen, there are almost certainly others that are yet to be seen.”
An Apple spokesperson was not immediately available to comment.
Source: CNBC
