iOS 14.5 to Make Zero-Click Attacks 'Significantly Harder'

[MacRumors]

Apple's impending iOS and iPadOS 14.5 update will make zero-click attacks considerably more difficult by extending PAC security provisions, according to Motherboard.

Apple has made a change to the way in which it secures its code in the latest betas of iOS 14.5 and iPadOS 14.5 to make zero-click attacks much harder. The change, spotted by security researchers, has now been confirmed by Apple and is slated to be included in the final update.

Zero-click attacks allow hackers to break into a target without the need for victim interaction, such as clicking a malicious phishing link. Zero-click attacks are therefore considerably harder for targeted users to detect and are considered to be much more sophisticated.

Since 2018, Apple has used Pointer Authentication Codes (PAC) to prevent attackers from leveraging corrupted memory to inject malicious code. Cryptography is applied to authenticate pointers and validate them before they are used. ISA pointers instruct a program about what code it should use when it runs on iOS. By using cryptography to sign these pointers, Apple is now extending PAC protection to ISA pointers.

"Nowadays, since the pointer is signed, it is harder to corrupt these pointers to manipulate objects in the system. These objects were used mostly in sandbox escapes and zero-clicks," security firm Zimperium's Adam Donenfeld told Motherboard. The change will "definitely make zero-clicks harder. Sandbox escapes too. Significantly harder." Sandboxes aim to isolate applications from each other to stop code from a program interacting with the wider operating system.

While zero-clicks will not be eradicated through this change, many of the exploits used by hackers and governmental organizations will now be "irretrievably lost." Hackers will now need to find new techniques to implement zero-click attacks on iPhone and iPad, but the security improvements to ISA pointers are likely to make a significant impact on the overall number of attacks on these devices.

Article Link: iOS 14.5 to Make Zero-Click Attacks 'Significantly Harder'

 

[farewelwilliams]

if only they made zero-click Siri interactions easier

 

[macsplusmacs]

always good to hear they are staying on top of things like this.

 

[I7guy]

I like how Apple just does these stealth improvements and then wham, forces some big change somewhere.

 

[Skika]

if only they made zero-click Siri interactions easier

Why the negative/cynical spin on everything?

 

[_Spinn_]

More great security improvements. I'm glad Apple is keeping up these kinds of updates.

 

[otternonsense]

When do we expect it to release?

 

[TheYayAreaLiving 🎗️]

Good bye Facebook!

 

[V.K.]

Have there been any zero-click attacks in the wild? They certainly sound quite scary.

 

[farewelwilliams]

Why the negative/cynical spin on everything?

1. It's a joke.
2. Negative on *everything*? I've been accused of being an Apple fanboy and a cultist over 10 times in the pass 30 days.

 

[mi7chy]

Have there been any zero-click attacks in the wild? They certainly sound quite scary.

https://www.zdnet.com/article/zero-click-ios-zero-day-found-deployed-against-al-jazeera-employees/

https://www.wired.com/story/bezos-phone-hack-mbs-saudi-arabia/

 

[acblue94]

Apple's impending iOS and iPadOS 14.5 update will make zero-click attacks considerably more difficult by extending PAC security provisions, according to Motherboard.

Apple has made a change to the way in which it secures its code in the latest betas of iOS 14.5 and iPadOS 14.5 to make zero-click attacks much harder. The change, spotted by security researchers, has now been confirmed by Apple and is slated to be included in the final update.

Zero-click attacks allow hackers to break into a target without the need for victim interaction, such as clicking a malicious phishing link. Zero-click attacks are therefore considerably harder for targeted users to detect and are considered to be much more sophisticated.

Since 2018, Apple has used Pointer Authentication Codes (PAC) to prevent attackers from leveraging corrupted memory to inject malicious code. Cryptography is applied to authenticate pointers and validate them before they are used. ISA pointers instruct a program about what code it should use when it runs on iOS. By using cryptography to sign these pointers, Apple is now extending PAC protection to ISA pointers.

"Nowadays, since the pointer is signed, it is harder to corrupt these pointers to manipulate objects in the system. These objects were used mostly in sandbox escapes and zero-clicks," security firm Zimperium's Adam Donenfeld told Motherboard. The change will "definitely make zero-clicks harder. Sandbox escapes too. Significantly harder." Sandboxes aim to isolate applications from each other to stop code from a program interacting with the wider operating system.

While zero-clicks will not be eradicated through this change, many of the exploits used by hackers and governmental organizations will now be "irretrievably lost." Hackers will now need to find new techniques to implement zero-click attacks on iPhone and iPad, but the security improvements to ISA pointers are likely to make a significant impact on the overall number of attacks on these devices.

Article Link: iOS 14.5 to Make Zero-Click Attacks 'Significantly Harder'

How about fix HomeKit. My custom wallpapers continue to reset and default back to the green wallpaper.

 

[Captain Trips]

1. It's a joke.
2. Negative on *everything*? I've been accused of being an Apple fanboy and a cultist over 10 times in the pass 30 days.

Only 10 in the last 30 days? Dude, you are slacking off!

 

[iGeneo]

How about fix HomeKit. My custom wallpapers continue to reset and default back to the green wallpaper.

This is a HUGE crisis.... hopefully they fix it :/

 

[macsplusmacs]

Found this story too:

Apple Is Going to Make It Harder to Hack iPhones With Zero-Click Attacks

Multiple exploit developers tell Motherboard an upcoming change in iOS could make zero-click exploits harder to pull off.

www.vice.com

 

[Realityck]

Apple's impending iOS and iPadOS 14.5 update will make zero-click attacks considerably more difficult by extending PAC security provisions, according to Motherboard.

While zero-clicks will not be eradicated through this change, many of the exploits used by hackers and governmental organizations will now be "irretrievably lost." Hackers will now need to find new techniques to implement zero-click attacks on iPhone and iPad, but the security improvements to ISA pointers are likely to make a significant impact on the overall number of attacks on these devices.

Good for Apple improving iOS and iPadOS security. ?

 

[Apple_Robert]

When do we expect it to release?

Whenever 14.5 is released.

 

[Apple_Robert]

How about fix HomeKit. My custom wallpapers continue to reset and default back to the green wallpaper.

I would much rather have a more secure phone and OS, than focusing on custom wallpapers. I guess you don't care much about safety and security on your iPhone.

 

[BWhaler]

I’ve said it before, and I’ll say it again, 14.5 is looking to be epic.

I hope Apple is pounding out bugs and optimizing behinds the scenes too.

 

[spartan1967]

if only they made zero-click Siri interactions easier

I'll take one-click if it would prevent Siri from interacting when you don't want it to.

 

[hatchettjack]

g

Whenever 14.5 is released.

get the beta! its out and works awesome!

 

[Apple_Robert]

g

get the beta! its out and works awesome!

I was very tempted. However, I think in another month, 14.5 will be released. I wouldn't want to risk messing up my watch without being able to downgrade. If I did the beta for the phone, I would want to get the features on the watch as well.

 

[hatchettjack]

I was very tempted. However, I think in another month, 14.5 will be released. I wouldn't want to risk messing up my watch without being able to downgrade. If I did the beta for the phone, I would want to get the features on the watch as well.

I’ve got the watch beta too! It works amazing as well

 

[genovelle]

I'll take one-click if it would prevent Siri from interacting when you don't want it to.

Like maybe saying

if only they made zero-click Siri interactions easier

they did. Just turn on hey Siri

 

[farewelwilliams]

they did. Just turn on hey Siri

and it doesn't always activate when i do it and it activates when i don't intentionally do it