A Google security engineer has discovered critical bugs in iOS that allowed an attacker to obtain access to data stored on an iPhone.
According to a new report from ZDNet, two security researchers part of Google’s Project Zero group discovered six vulnerabilities within iOS that could be easily exploited by malicious parties.
All of the vulnerabilities, which required no user interaction, were responsibly reported to Apple by Samuel Groß and Natalie Silvanovich of Google Project Zero, which the company patched just last week — with the exception of one vulnerability — with the release of the latest iOS 12.4 update.
As per the report:
Details about one of the “interactionless” vulnerabilities have been kept private because Apple’s iOS 12.4 patch did not completely resolve the bug, according to Natalie Silvanovich, one of the two Google Project Zero researchers who found and reported the bugs.
The four bugs are CVE-2019-8641 (details kept private), CVE-2019-8647 , CVE-2019-8660, and CVE-2019-8662 . The linked bug reports contain technical details about each bug, but also proof-of-concept code that can be used to craft exploits.
The other two bugs rely on the memory of the device:
The fifth and sixth bugs, CVE-2019-8624 and CVE-2019-8646 , can allow an attacker to leak data from a device’s memory and read files off a remote device — also with no user interaction.
ZDNet notes that at least three of the flaws opened the user to a serious attack, in which the malcontent prying open your phone can start executing code. All the attacker needs to do is send a malicious message to a device, as the code simply runs when you open and view the message — which most people will.
Essentially, all five of these flaws could have been exploited without any user-end interaction required. The full list can be viewed here; interestingly, the first two in this list are not mentioned in the tweets, though their effects read more or less the same as the aforementioned CVE-2019-8647. Silvanovich also noted that she would further discuss these bugs at her upcoming Black Hat USA talk next month.
In recent years, Google’s Project Zero team has helped discover security vulnerabilities in the company’s own products, as well as those developed by other tech giants. Earlier this month, the team found a flaw within Apple’s iMessage platform that would cause iPhones to repeatedly crash, an issue that the Cupertino company has since fixed.
