4 ms·

I thought the exploited holes were patched by iOS at some point. How are these phones still getting hacked?

azernik 5y ago
This is being publicized only now. The issues were patched in September, the exploit was being used as of February, and it took some time for someone to notice that an @state.gov Apple ID was among the compromised phones.
kitsunesoba 5y ago
People are notoriously bad at keeping their devices up to date, with some even intentionally disabling updates. This can be prevented by the IT department having MDM profiles with strict update enforcement in place, but I don’t have much hope that the IT department of any given US government office is particularly capable or competent.
- brynx97 5y ago
  The article doesn't say if they were personal or work provided phones. Many people living/working overseas have work and personal phones. Also, almost all of those with personal phones get a local SIM, so they'd get a local non-US (not +1) phone number. I used to be an IT admin with DOS overseas. Updates were enforced, and phones were disabled if they were not upgraded to the most recent version. Starting in about 2019, mobile device security went into overdrive and is very serious now. Additionally, the MDM profiles are quite limiting, so this pushed most people to get personal phones. A huge pain for records retention.
zibzab 5y ago
Because there is a never-ending supply of vulnerabilities in our smartphones. A system this complex can never be secure no matter what google/apple PR dep claims.
odiroot 5y ago
Exploits are now a multi-billion dollar market. And iPhones can be obtained worldwide. You just need one person with questionable morals, good hardware hacking skills and a need for some hefty payout. There's a lot of buyers, Five Eyes, China, Russia and naturally companies like NSO.
ryneandal 5y ago
There's always another zero day
14 5y ago
In past exploits were used for jailbreaking. Now they can be sold for 6 figures. The incentive to report vulnerabilities or even use them casually for jailbreaking has gone way down. I think the only way would be for Apple to offer 6 figure pay outs for the exploits. Maybe they could get a tax write off.

This is being publicized only now. The issues were patched in September, the exploit was being used as of February, and it took some time for someone to notice that an @state.gov Apple ID was among the compromised phones.

kitsunesoba 5y ago

People are notoriously bad at keeping their devices up to date, with some even intentionally disabling updates. This can be prevented by the IT department having MDM profiles with strict update enforcement in place, but I don’t have much hope that the IT department of any given US government office is particularly capable or competent.

brynx97 5y ago
The article doesn't say if they were personal or work provided phones. Many people living/working overseas have work and personal phones. Also, almost all of those with personal phones get a local SIM, so they'd get a local non-US (not +1) phone number. I used to be an IT admin with DOS overseas. Updates were enforced, and phones were disabled if they were not upgraded to the most recent version. Starting in about 2019, mobile device security went into overdrive and is very serious now. Additionally, the MDM profiles are quite limiting, so this pushed most people to get personal phones. A huge pain for records retention.

zibzab 5y ago

Because there is a never-ending supply of vulnerabilities in our smartphones. A system this complex can never be secure no matter what google/apple PR dep claims.

odiroot 5y ago

Exploits are now a multi-billion dollar market. And iPhones can be obtained worldwide. You just need one person with questionable morals, good hardware hacking skills and a need for some hefty payout. There's a lot of buyers, Five Eyes, China, Russia and naturally companies like NSO.

ryneandal 5y ago

There's always another zero day

14 5y ago

In past exploits were used for jailbreaking. Now they can be sold for 6 figures. The incentive to report vulnerabilities or even use them casually for jailbreaking has gone way down. I think the only way would be for Apple to offer 6 figure pay outs for the exploits. Maybe they could get a tax write off.