Everyone now appears to agree with one of Apple’s statements: that the iOS
Mail app vulnerabilities discovered by ZecOps cannot be exploited on their own. Apple said:
The researcher identified three issues in Mail, but alone they are insufficient to bypass iPhone and iPad security protections.
ZecOps accepts this, and it has been backed by other security researchers. However,
as we noted last week, that doesn’t mean that they couldn’t have been exploited alongside other vulnerabilities in order to carry out a successful attack.
The denial is not a complete refutation of the claim. It may be the case that the specific vulnerabilities alone cannot bypass security safeguards, but that they can be combined with existing exploits in order to do so.
Wired reports that our take has now been echoed by two high-profile security researchers.
iOS security researcher and Guardian Firewall creator Will Strafach points out that while Apple and ZecOps are correct about the limited utility of the Mail bugs alone, it’s still important to take these types of bugs seriously.
“A zero-click like this is especially interesting because it is not a full exploit chain, yet due to the nature of how it works, it could enable something like a smash-and-grab for mailbox data. Even the prospect of copying emails then self-deleting the crafted ‘attack email’ is quite scary.”
