Apple Patches Critical Image Preview Bug
Apple has patched a security flaw that could compromise phones and tablets just by users receiving a message. The exploit would use an attachment in iMessages but wouldn't require the user to click or open it.
It's a potentially very serious flaw though ironically that may be the saving factor for most ordinary users. Because it's so serious, experts believe it's most likely to be used for highly targeted attacks.
The bug was discovered by researchers at the University of Toronto, who say it's an example of "zero-click spyware". While they've seen similar attacks on Apple devices before, it's the first time they've been able to access the code used in the attack and analyze the tactics. (Source: citizenlab.ca)
Bogus Image Files Unlock Attack
According to the researchers, the attack involved messages with attached files that claimed to be GIF image files. In fact most were Photoshop (PSD) image files while others were PDF files.
The attack was highly technical, but in simple terms it took advantage of the way Apple devices turn the information in an image file and then actually display the image on the screen. In effect the attackers were able to manipulate the process to produce computer code that was much larger than the space Apple allocates for the operation. This code effectively "bursts through" into other parts of the device's memory.
Apple has confirmed the exploit could allow attackers to carry out arbitrary code execution. That's the holy grail for attackers as it means they can run malware directly on the device.
Attack Similar to Amazon CEO Jeff Bezos Hack
This type of attack is very similar to the one that affected Jeff Bezos (CEO of Amazon), which was also linked to Crown Prince Mohammed bin Salman. Around the same time, the Prince was also claimed to be responsible for Jamal Khashoggi's brutal death in which he was murdered for being dissident to the kingdom of Saudi Arabia. For those who are interested, refer to "The Dissedent" documentary on Netflix.
Mercenaries Behind Attack
The Toronto researchers say they found the attack evidence on the phone of a Saudi political rights activists. They say they are highly confident it's the work of an Israeli group called NSO. That group isn't thought to be politically motivated but rather act as "hackers for hire".
Apple's security update for the problem covers most iOS devices including phones and tablets dating back to around 2014. Most users should have iOS updates set to download and install automatically. Those who don't should certainly do this manually.
The closest thing to good news in this situation is that the way an attack works, including sending a message, means it's probably not efficient for attackers to use "spray and pay" tactics where they simply go after as many people as possible in the hope of increasing their success. Instead it's more likely they'll go after specific individuals who they either want to disrupt or access their personal data. (Source: bbc.co.uk)
What's Your Opinion?
Do you use Apple products? Do you have automatic updates switched on? Do you generally feel more secure using iOS than other systems?
Most popular articles
- Which Processor is Better: Intel or AMD? - Explained
- How to Prevent Ransomware in 2018 - 10 Steps
- 5 Best Anti Ransomware Software Free
- How to Fix: Computer / Network Infected with Ransomware (10 Steps)
- How to Fix: Your Computer is Infected, Call This Number (Scam)
- Scammed by Informatico Experts? Here's What to Do
- Scammed by Smart PC Experts? Here's What to Do
- Scammed by Right PC Experts? Here's What to Do
- Scammed by PC / Web Network Experts? Here's What to Do
- How to Fix: Windows Update Won't Update
- Explained: Do I need a VPN? Are VPNs Safe for Online Banking?
- Explained: VPN vs Proxy; What's the Difference?
- Explained: Difference Between VPN Server and VPN (Service)
- Forgot Password? How to: Reset Any Password: Windows Vista, 7, 8, 10
- How to: Use a Firewall to Block Full Screen Ads on Android
- Explained: Absolute Best way to Limit Data on Android
- Explained: Difference Between Dark Web, Deep Net, Darknet and More
- Explained: If I Reset Windows 10 will it Remove Malware?
![](/graphics/dennisfaas.jpg)
My name is Dennis Faas and I am a senior systems administrator and IT technical analyst specializing in cyber crimes (sextortion / blackmail / tech support scams) with over 20 years experience; I also run this website! If you need technical assistance , I can help. Click here to email me now; optionally, you can review my resume here. You can also read how I can fix your computer over the Internet (also includes user reviews).
We are BBB Accredited
![](https://www.infopackets.com/graphics/bbb.png)
We are BBB accredited (A+ rating), celebrating 21 years of excellence! Click to view our rating on the BBB.
Comments
Karma
Remember back in the day when Mac snobs were so damned smug with their claim that Apple systems were *never* hacked and *never* infected with viruses?
Welcome to the real world, Apple.