8 ms·
Bank of America Email: “Update Your iPhone”
I got an email from Bank of America essentially: "Hey, Update your iPhone". I imagine there is a pretty gnarly exploit.
- justinzollars 4y agohttps://support.apple.com/en-us/HT213414 https://support.apple.com/en-us/HT213414
- testplzignore 4y agoAnd the other advisories: https://support.apple.com/en-us/HT213412 https://support.apple.com/en-us/HT213412 https://support.apple.com/en-us/HT213413 https://support.apple.com/en-us/HT213413
- kossTKR 4y ago"Processing maliciously crafted web content may lead to arbitrary code execution. An application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited." Sounds pretty serious, has active exploitation like this happened before in the Apple ecosystem or is this like most zerodays; edge cases and state level exploits that don't target broadly?
- clint 4y agoI have no hard data, but having looked at the security content of a lot of these over the years I'd wager WebKit has serious issues like this crop up more than any other component in iOS.
- googlryas 4y agoI'm curious if Lockdown mode would prevent this exploit? From Apple's Lockdown site, it's hard to tell the extent of what is locked down. > Web browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled unless the user excludes a trusted site from Lockdown Mode This is allegedly the fix for this exploit for webkit: https://github.com/WebKit/WebKit/pull/3023 https://github.com/WebKit/WebKit/pull/3023, it appears to at least somewhat related to the JIT, but I don't know enough about the exploit, or webkit to make that determination.
- OrangeMonkey 4y agoReceived one of these too. I do not update to the latest-and-greatest when it first comes out. I typically wait a bit for everyone else to 'beta test' it for me. If my bank is saying 'no, seriously, go fix this' maybe I should change my stance.
- jjulius 4y ago>Received one of these too. Was there any additional context or comments provided in the email? Both the initial post and this comment are pretty vague on what was communicated beyond the phrase, "Update your iPhone".
- dsizzle 4y agoNo additional context. They don't even specify which you used (I have both a Mac and an iPhone and both are up to date). The full text is below: "Update your iOS software and Safari® browser to keep your device(s) secure We noticed the iOS software version you’re using on your mobile device and/or the Safari browser on your computer may need to be updated. <Instructions on how to update>"
- themadturk 4y agoAmusing, as I also received the email and am using MacOS and iOS betas right now. I've updated into the future, for heaven's sake!
- jjulius 4y agoThanks, appreciate the response! :)
- justinzollars 4y agoI imagine they believe there is the potential to lose significant money
- treesknees 4y agoI wonder if the "actively being exploited" bit of the webkit vulnerability was targeting either Bank of America or other banking apps.
- mikece 4y agoI cannot help but read this as BofA saying their their systems are vulnerable to exploit more so than other banks who aren't sending out frantic "OMG! Upgrade your phone ASAP!!!" messages.
- spcebar 4y agoCould be that other banks are equally vulnerable and just not disclosing it. Hard to know without some insider knowledge. We'll know in a few months if class action lawsuits start popping up.
- aaaaaaaaata 4y agoOr...they don't want bad word of mouth after (many) someone(s) has their phone pwned and their BoA accts wiped out from within their own app..?
- JustSomeNobody 4y agoMaybe. But... If someone is using BoA and they have an issue related to this, are they going to blame BoA or are they going to blame Apple?
- amalcon 4y agoIt's an RCE (out of sandbox) exploited when you load a web page in Safari. Everyone is equally vulnerable to this, and you should be frantically upgrading. People panicked about Heartbleed, and rightly so, but this is arguably much worse,
- drcongo 4y agoI got one from a UK bank too
- beermonster 4y agoWhat did it say? I know Starling mailed customers.
- drcongo 4y agoIt was indeed Starling... Apple has today shared some information in relation to a security issue. This has the potential to allow others to gain access to information on your device if security updates are not up to date. We are contacting you as you have previously accessed your Starling account from an iOS device. We would strongly recommend that you ensure the security updates on your device are up to date to ensure that your device and information remains secure. To update: Go to your device Settings > General, then tap Software Update. If you are in need of further help updating your device, head to Apple Support.
- bilekas 4y agoI don't have a BoA account but it sounds like they might have safari embedded in there somewhere, or are depending on external links in some way. Either way its always a good idea to keep things updated!
- kemiller2002 4y agoThey do. Can confirm.
- meltyness 4y agoThis was awesome then, and horrifying now: https://www.youtube.com/watch?v=hFDGTVlgkmI https://www.youtube.com/watch?v=hFDGTVlgkmI
- colejohnson66 4y agoPeople were going around to Apple stores and jailbreaking the demo units. It’s a neat exploit, but it’s scary how much power a simple website could have.
- aaroninsf 4y agoI got this... ...and my phone is up to date (15.6.1). #fail
- FollowingTheDao 4y agoBetter to fail at being safe then fail at being unsafe.
- pen2l 4y agoI think it's the Webkit vulnerability CVE-2022-32893 that is of concern. As I understand there's this one and the other vulnerability is in the kernel which requires physical access to exploit. The former lets nefarious actors compromise devices without physical access and is in fact being actively exploited in the wild (by Apple's own admission), so it's encouraging to see that BoA is taking the initiative to go so far as emailing users to update to keep them safe.
- Havoc 4y agoYeah got same from employer - within hours of release on the 18th. Guessing there is a service of some sort IT team uses to monitor cause they're always very fast on highlighting the serious ones
- deleted 4y ago[deleted]
- X-Istence 4y agoI got this email too from Bank of America... but I already updated all my devices the day the new version came out.
- NoboruWataya 4y agoGot an email from my employer threatening to disconnect my iPhone from their network if I don't update by Friday.
- lukasyuy5 4y agoHello