Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Apple's iOS 14.8 Update Fixes Zero-Click Exploit Used to Distribute Pegasus Spyware

I7guy said:
Apple seemingly want this update to just "be there". Probably the reason there was no beta.
Click to expand...

Because it was an easy fix? Some of these 'zero days', and other security flaws are from oversights by programmers and insufficient testing. Fixing some are almost as easy as 'dotting the 'i''. Does there need to be a prolonged beta testing regimen for a simple fix? Especially when it pisses off a known PITA? I love it actually... 'Take this, ******s!!!'

Love it, love it, love it...
 
  • Like
Reactions: I7guy
Localcelebrity said:
The ultimate solution in security:

Click to expand...

Actually wouldn't the 'ultimate solution in (computer) security' be that it's in a locked brick vault, and the operator only talks to people through a phone, and nothing comes in, or goes out except printed paper?

I had a client that thought they 'had the tiger by the tail'. Their CAD systems, and server, weren't connected to the internet, but every USB drive they used was at one point. (Oh, and no antivirus, because stupid works like that?)

Yeah, their server got SLAMMED!!! All their files were corrupted, and they weren't doing backups, (because, again, stupid) because apparently they lived in a fantasy world that had gaping holes in it...
 
timeislove said:
Should I wait a little longer as I suppose the new iOS 15 would incoprate this security fix?
Click to expand...

HAH!!! Don't assume anything. It's possible, and I'd hope, but Microsoft, back 'in the day', would release updates to their OS, and it would NOT include a patch from the previous version. Oh, and some patches would undo previous fixes. Yes, that was the joy of using Microsoft NT4. Those issues didn't happen often, but they did happen. DOH!!!
 
Last edited:
  • Like
Reactions: BulkSlash and haruhiko
timeislove said:
Should I wait a little longer as I suppose the new iOS 15 would incoprate this security fix?
Click to expand...
Given how small the update is for iOS 15 except the photo text thing… I think you’d better upgrade to 14.8 first.
 
timeislove said:
Should I wait a little longer as I suppose the new iOS 15 would incoprate this security fix?
Click to expand...
Wait for what? Are you paying per download? Per bit? I have never understood posts like this. Install. The. Thing. Are you accomplishing something by “holding off”? Waiting for the next version you will likely ALSO hold off on? Do you enjoy micromanaging your OS version?
 
Oh...nice surprise actually. I had no idea this was out until I came on the site, no reason to think there was another update until 15 (I assume that's coming on Friday).

Thanks!
Updating now.
 
Shirasaki said:
Reminds me of apple unwilling to outcompete government or institutions payments to security researchers choosing To notify apple security bugs before selling them off.
Click to expand...

What is a fair price, $1, $100,000, $1,000,000 , $50,000,000, 10 Trillion ?

Exploits are the new arms race.

What prevents the same person from collecting $1,000,000 from Apple and at the same time selling the exploit to 10 others?
 
ender78 said:
What is a fair price, $1, $100,000, $1,000,000 , $50,000,000, 10 Trillion ?

Exploits are the new arms race.

What prevents the same person from collecting $1,000,000 from Apple and at the same time selling the exploit to 10 others?
Click to expand...
Or those “security researchers” sell all of those exploits to governments etc leaving apple and general public in the dark, then we may have a fully compromised system. What cost do Apple need to pay for a safer system?

You know it’s an arms race, yet sacrifice nothing to outcompete the adversaries?
 
Shirasaki said:
Or those “security researchers” sell all of those exploits to governments etc leaving apple and general public in the dark, then we may have a fully compromised system. What cost do Apple need to pay for a safer system?

You know it’s an arms race, yet sacrifice nothing to outcompete the adversaries?
Click to expand...

And yet there are 'hackers' out there that will turn over info on 'zero days' for the good of everyone. Sure, they wouldn't turn down money, a bounty, but they also believe that everyone benefits when holes are fixed.

That was probably why I was so completely horrified to hear that the various 'three letter agencies' in this country were covertly expoiting those zero days and not reporting their existence to the involved parties. Imagine OUR government, exploiting zero day holes, against US?!?! 'With friends like that', huh?

And finding out some of those same agencies were developing their own 'tools', and cooperating with somewhat nefarious groups that dealt in such things? OUR government agencies should be helping secure OUR computers and computing devices, not hiding tools that they are using, and they know others are using too. At some point, if there are no more secrets, except for the victims, we are ALL victims...
 
  • Like
Reactions: BulkSlash
PinkyMacGodess said:
And yet there are 'hackers' out there that will turn over info on 'zero days' for the good of everyone. Sure, they wouldn't turn down money, a bounty, but they also believe that everyone benefits when holes are fixed.

That was probably why I was so completely horrified to hear that the various 'three letter agencies' in this country were covertly expoiting those zero days and not reporting their existence to the involved parties. Imagine OUR government, exploiting zero day holes, against US?!?! 'With friends like that', huh?

And finding out some of those same agencies were developing their own 'tools', and cooperating with somewhat nefarious groups that dealt in such things? OUR government agencies should be helping secure OUR computers and computing devices, not hiding tools that they are using, and they know others are using too. At some point, if there are no more secrets, except for the victims, we are ALL victims...
Click to expand...

everything is a play at this point. 100%. It’s time we realize.
 
That is really good news. But everyone should stop cheering. A tremendous amount of bugs was found in iOS within the last years, even the traders stopped buying zero day exploits. NSO could have some other exploits as a fallback solution to hack iOS.
 
  • Like
Reactions: tunastink and DCIFRTHS
Apple: iMessage is our main tent pole in keeping people on iPhones. So let other security researchers look for bugs and let organizations exploits it. We'll just fix it once somebody tells us there's something wrong.
 
Last edited by a moderator:
  • Like
  • Haha
Reactions: VulchR, LV426 and BulkSlash
dumastudetto said:
At least these nasties get patched on *every* supported iOS device on day one.

Android users, good luck.
Click to expand...
I agree and disagree at the same time.

In terms of monthly security patches, yes, Android OEMs, other than Samsung flagships and Google, sucks. Google can do better, as right now, they only require OEMs to give quarterly security updates for 2 years at minimum to get certification. Obviously everybody is doing the bare minimum, or even less, especially the Chinese OEMs (where some of them have been caught faking security patches, only changing the text without actually pushing the patch. It shows how lazy these OEMs are).

At the same time, Android has evolved and been compartmentalized that users are still protected. Let's say there's a security issue on Google Messages app. It's available via the Play Store, so it can be updated by Google anytime for as long as Google wants, even after the phone itself stops getting OS updates. Same with the Chrome browser, Google Maps, etc. This is in contrast with Apple where everything is monolithic. You will only get Safari updates part of iOS updates.

Also, there's Play Services. This allows Google to push updates and features to even old Android devices. Take Nearby Share, Android's version of Airdrop. It's a new feature announced in 2020, but it is supported way down to Android 6 devices thanks to Play Services.

I agree that I wish Android can be more proactive in pushing the monthly security patches. At the same time, the challenges have forced Google to innovate by compartmentalizing Android piece by piece that some part of it can be updated independently from the OEMs/carriers.
 
  • Like
Reactions: tunastink and BulkSlash
Reading the technical analysis makes you wonder how the hell they came up with this.
Glad they found it, but what an impressive piece of development. No wonder they are paid in the hundred of millions.
 
wirtandi said:
Question, how urgent do I need to download this update? From my understanding, a PDF download is what triggers this exploit? So if I have not downloaded and opened a PDF file from a dodgy website, I should be fine, is that how it works?

Im just confused because I have only been using my phone to visit social media, firefox, and a few trusted apps, and nothing else.
Click to expand...

Drat. I just typed a website address wrongly and accidentally went to some weird site and a PDF just like downloaded itself...

It only took a few minutes to go from start of download to being applied. Why delay at all? You could have initiated the download faster than typing your response. And by the time you have checked for further comments a couple of times, your device would have been updated.

Obviously, some people will be in circumstances which make it awkward or expensive (paying by the byte for downloads).
 
For the first time ever, I won’t be updating my iPhone to the latest and greatest version of iOS this fall.

iOS 15 seems as stable as iOS 11/13 did at this point (not a compliment).

I can see SharePlay being ripe for being hacked, for example (yes I know it’s not coming in the 15.0 release).

I want Apple to pause and to really step back and take time fix the errors that they have riddled through iOS (by all accounts) and only work on minor easy to implement ‘quality of life’ new features.

At this point in iOS’s maturity, adding new features to iOS seems to be mostly so Apple has something to say at WWDC (the Safari redesign that absolutely no-one was asking for, for example).

And it’s the new emojis in x.1 that cause most major version upgrades, anyhow (is my understanding).

So perhaps the WWDC keynote could go back to being more developer focussed & we can get proper reworking of key layers in iOS & numerous misc bug fixes.

Then everyone is a winner - except for Apple’s marketing dept 🙄.
 
  • Like
Reactions: Yammabot and DCIFRTHS
If a phone has already been targeted/infected, and a new OS is installed, does anyone know if the installer removes the nefarious code? If not, is the user stuck with a compromised phone, but just protected against the latest zero day exploit?
 
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back