4 ms·

Apple emergency updates fix 3 new zero-days exploited in attacks

68 points by cdme 3y ago

chatmasta 3y ago
These were all patched shortly after iOS 17 was released, and all appear to affect both 16 and 17. Does that imply the researchers were holding onto them to see whether the vulnerabilities still existed in iOS 17?
- dimmke 3y ago
  No because anybody could have gotten ahold of the release version of iOS 17 well before Monday when it was officially released. It was on the beta channel, which I believe anybody can opt into. Apple wouldn't wait to squeeze in a fix for a security exploit for a major marketing version update of their OS.
- kramerger 3y ago
  In general when something is actively exploited in the wild there is no embargo allowed. But there is not much information available, probably due to researchers having their hands full. Or maybe its a private agreement with Apple
kramerger 3y ago
That's what, 10-15 zero days in about 10 weeks? What is going on at Apple?? And it's not like these were found due to increased testing and code reviews. Many were observed in the wild by 3rd parties.
- tedunangst 3y ago
  Given sandboxing, it's unlikely we'll see many one off exploits. Every successful exploit affects multiple components now.
- dimmke 3y ago
  I agree this is a pretty terrible look for Apple. And it's annoying as a consumer. I've noticed that these zero days almost always affect macOS and watchOS too. You can see that new versions of both have also dropped today: https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222 So as a consumer, I am having to update my phone, tablet and laptop frequently now to guard against attacks that were actively exploited in the wild. I will be really curious to see what Apple does about this. They've already introduced a "Lockdown" mode and rapid security response updates but I would not be surprised if this galvanizes an even bigger shift.
- deleted 3y ago
  [deleted]
- Serenacula 3y ago
  Perhaps this is the start of AI hacking in the real world
fowl2 3y ago
Interesting there doesn't seem to be an update available for those opted-in to the public beta. The "RTM" release (21A329) is still "up to date" apparently.

68 points by cdme 3y ago

These were all patched shortly after iOS 17 was released, and all appear to affect both 16 and 17. Does that imply the researchers were holding onto them to see whether the vulnerabilities still existed in iOS 17?

dimmke 3y ago
No because anybody could have gotten ahold of the release version of iOS 17 well before Monday when it was officially released. It was on the beta channel, which I believe anybody can opt into. Apple wouldn't wait to squeeze in a fix for a security exploit for a major marketing version update of their OS.
kramerger 3y ago
In general when something is actively exploited in the wild there is no embargo allowed. But there is not much information available, probably due to researchers having their hands full. Or maybe its a private agreement with Apple

kramerger 3y ago

That's what, 10-15 zero days in about 10 weeks? What is going on at Apple?? And it's not like these were found due to increased testing and code reviews. Many were observed in the wild by 3rd parties.

tedunangst 3y ago
Given sandboxing, it's unlikely we'll see many one off exploits. Every successful exploit affects multiple components now.
dimmke 3y ago
I agree this is a pretty terrible look for Apple. And it's annoying as a consumer. I've noticed that these zero days almost always affect macOS and watchOS too. You can see that new versions of both have also dropped today: https://support.apple.com/en-us/HT201222 https://support.apple.com/en-us/HT201222 So as a consumer, I am having to update my phone, tablet and laptop frequently now to guard against attacks that were actively exploited in the wild. I will be really curious to see what Apple does about this. They've already introduced a "Lockdown" mode and rapid security response updates but I would not be surprised if this galvanizes an even bigger shift.
deleted 3y ago
[deleted]
Serenacula 3y ago
Perhaps this is the start of AI hacking in the real world

fowl2 3y ago

Interesting there doesn't seem to be an update available for those opted-in to the public beta. The "RTM" release (21A329) is still "up to date" apparently.