0

Title.

Are there any known instances of exploits targeting iOS (versions 11 and later) with the following characteristics?:

  • Allows remote, unauthenticated installation of malware on the device. Examples include browsing an infected site and getting malware installed as a result. Other examples could include a vulnerability in an app that somehow allows the installation of malicious scripts and programs.
  • The malware can target any app (outside the vulnerable app that lets it in) once installed. For example, a piece of malware that comes in via a browser flaw "escaping" its application sandbox and spying on other apps (or running unannounced in the background) - allowing it to extract user-sensitive data like location history from GPS apps, conversation history from messaging/email apps, and payment info from banking apps.
  • Doesn't require entering a passcode, App Store login, or Touch/Face ID. Installation is probably silent.

Due diligence: I looked up known CVEs for Apple iOS and it appears there was only 1 exploit in 2016, which intuitively suggests a solid security record.

https://www.cvedetails.com/product/34425/Apple-IOS.html?vendor_id=49

Clicking on it finds a 10/10 (extremely serious) exploit: https://www.cvedetails.com/vulnerability-list/vendor_id-49/product_id-34425/Apple-IOS.html

Further inspection suggests the exploit is unique to version 9.3.2 (on iOS, although there are many other operating systems and frameworks that used the flawed library in question): https://www.cvedetails.com/cve/CVE-2016-4448/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.