Apple corrects the iPhone and iPad Bug used in an “extremely sophisticated attack”
On Monday, Apple published updates for its mobile operating systems for iOS and iPados, which corrected a defect which, according to the company, “could have been exploited in an extremely sophisticated attack against specific targeted individuals”.
In publication notes for iOS 18.3.1 and iPados 18.3.1The company said that vulnerability has disabled the limited USB mode “on a locked device”. Presented In 2018The limited USB mode is a safety feature that blocks the possibility for an iPhone or an iPad to send data to a USB connection if the device is not unlocked for seven days. Last year, Apple has published another safety feature This restarts the devices if they are not unlocked for 72 hours, which makes it more difficult for the application of laws or criminals using forensic tools to access data on these devices.
On the basis of its language used in its security update, Apple suggests that the attacks have probably been carried out with the physical control of a person’s device, which means that anyone abused this flaw must be connected to the Apple devices of the person with a forensic apparatus like Brief Or GrayTwo systems that allow police forces to unlock and access data stored on iPhones and other devices.
Vulnerability was discovered by Bill MarczakPrincipal researcher at the Citizen Lab, a group from the University of Toronto who is investigating cyber attacks against civil society.
Contact us
Do you have more information on this defect, or other zero-day and cyber attacks? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai safely on the signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or e-mail. You can also contact Techcrunch via Secure.
Apple did not respond to a request for comments in press times.
Marczak told Techcrunch that he could not comment on the file at this stage.
We do not know at this stage which was responsible for the abuse of this flaw and against which it was used. But there have been documented cases in the past where the police have used forensic tools, which generally abuse so-called Zero day defects In devices like the iPhone, to unlock devices and access data inside.
In December 2024, Amnesty International published a report documenting a series of attacks by the Serbian authorities where They used Ceebrite to unlock the phones of the country’s activists and journalistsThen install malware on them.
Safety researchers said that foreign medical aircraft, Celibrite were probably used “largely” on civil society individuals, according to Amnesty.
