6 ms·
Apple releases emergency update to fix zero-day exploited in attacks
- wannacboatmovie 3y agoWhat about older OSes? Are they not vulnerable or simply ignored?
- treesknees 3y agoApple only releases Rapid Security Response updates for the latest versions of its operating systems [1]. So any devices running iOS 16.4.X or MacOS 13.3.X won't see one, and anything before that didn't support Rapid Security Response updates. Unfortunately there's not enough information available to know if older releases are vulnerable. [1] https://support.apple.com/en-us/HT201224 https://support.apple.com/en-us/HT201224
- vaxman 3y ago> Unfortunately there's not enough information available to know if older releases are vulnerable. Assume YES.
- vaxman 3y agoHell, what about newer OSes ...like iOS 17 Beta? visionOS 1 Beta?
- gumby 3y agoBetas don't need a rapid response; people running beta can wait. Though for all you know this bug doesn't even exist in the newer versions. Or the mitigation was already in the beta but this rapid response required an extra day for testing as it is being shipped to users.
- jifncidbdi 3y agopeople will run whatever. recently the pixels had a remote exploit just by being connected to a 4g network. we got two victims in our group in the 3wk google took to patch (it was the first late security update on the same time)... and we did warn everyone to turn radio off (or limit to 3g if out of the us)... nobody cares and they just use the device thinking they won't be a target.
- vaxman 3y agoThat's not how it works. The peeps working on the new stuff ARE WORKING ON THE NEW STUFF. This would fall under backports (er, forward ports?)
- Rolcol 3y agoApple also released Safari 16.5.2 for Big Sur and Monterey to address this: https://support.apple.com/en-us/HT213826 https://support.apple.com/en-us/HT213826
- jiveturkey 3y agohttps://arstechnica.com/gadgets/2022/10/apple-clarifies-security-update-policy-only-the-latest-oses-are-fully-patched/ https://arstechnica.com/gadgets/2022/10/apple-clarifies-secu... I remember just after this announcement was the first super-critical update for ventura. It was about 31 days before older OS versions got the patch, even though they were identified as vulnerable at the time of the ventura update. :(
- ratg13 3y agoI’ve always been curious to know .. with all of the random 0-days in mobile operating systems (iOS, for example) How do you know that an attacker is not persisting in the system if you click a bad link before a patch gets applied?
- dmitrygr 3y agoPersisting in the fs is much harder than just getting code execution. Not impossible (nothing is) but much harder (and thus likely less common), due to signature checking
- _8j50 3y agoYou're assuming a click/tap is involved. Several iOS exploits are 0-click.
- ratg13 3y agoYour pedantry is noted, but this would not change the answer to the question at all.
- _8j50 3y agoPersistence is not needed when they can just access your device any time. That part was what addressed your question.
- ratg13 3y agoThanks for clearing that up. My question was meant more about after a device is patched.. how you can know it's secure.
- _8j50 3y agoForensic approach is to get a disk image(iOS just has backups) and analyze that. You can't ever be 100% sure. Can't prove a negative (no compromise) you can only prove positives based on the state of the device you can measure. Personally, I only use mobile devices for internet browsing and using apps like uber, I only have like one app I should probably stop using but to the most part I always assume any mobile device out there is or can readily be compromised.
- mensetmanusman 3y agoThis is interesting, it installs without a restart almost immediately.
- urda 3y agoMy iPhone required a restart, but the whole process took less than 5 minutes.
- mensetmanusman 3y agoWhich device? ip14pm here
- kencausey 3y agoI had to restart with a 2020 SE.
- noxon 3y agoMy iPhone 14 pro max required a restart.
- vb3 3y agothat's interesting! most likely because it's just app update to safari. they should really allow built-in apps to get updated via App Store...
- Gigachad 3y agoWhy would it matter? They can deploy updates via the existing system instantly.
- vb3 3y agolooks like update has been pulled for now https://forums.macrumors.com/threads/apple-releases-rapid-security-response-updates-for-ios-16-5-1-and-macos-13-4-1-to-fix-actively-exploited-vulnerability.2395527/page-5 https://forums.macrumors.com/threads/apple-releases-rapid-se...