Why You Shouldn’t Wait To Update Your Apple Device
Apple has identified serious vulnerabilities in its devices and is urging users to update their tech immediately.
This article is more than 2 years old
Apple users beware and take heed. The company is strongly recommending updating the software on their devices after they discovered an operating systems vulnerability that already “may have been actively exploited.” The updates were posted on August 17 and 18 along with the warning to update now.
This new vulnerability affects iPhones that go back to the 6S model. Also affected is the iPad 5th generation model and later, the iPad Air 2 model and later, the iPad mini 4 and later, every iPad Pro model, and finally, the 7th generation iPod touch. This is serious stuff that if not corrected, could have some damaging results.
The new update is iOS 15.6.1 and fixes two security holes that have already been used to attack iPhones. The first security hole fixed is one that centers around the vulnerability in the iPhone Kernel (CVE-2022-32894) that would allow an app to execute code with kernel privileges. In other words, this is one very serious vulnerability. Apple did report on its support page that they were “aware of a report that this issue may have been actively exploited.”
The second vulnerability that iOS 15.6.1 patched up was the flaw seen in WebKit, Safari’s browser engine. This CVE-2022-32893 issue could allow for arbitrary code execution. It is Apple’s belief that this vulnerability has already been exploited in real-life scenarios by attackers. Apple said in their release that the 15.6.1 update “provides important security updates and is recommended for all users.”
Apple’s brand-new iOS 15.6.1 update is the second by the tech giant in the past few weeks. iOS 15.6 was released back in July to fix earlier vulnerability issues. In fact, since the start of the year, Apple has released over a dozen fixes to its operating system.
These new vulnerabilities also extend out to Apple’s Mac computers that are running the company’s Monterey operating system. It also affects Apple’s Safari browser on the Big Sur and Catalina operating systems. You can understand why Apple is adamant that this fix happens.
As a way to prevent attackers from gaining more information about what the iOS 15.6.1 fixes, Apple does not provide any more details about what iPhone vulnerabilities were fixed. It should go without saying, although Apple pretty much has, that this fix is a big one. So, without any more information as to who the possible or intended target of these attacks was directed at, the most logical thing to do is to update your device.
Sean Wright is an independent security researcher and he told Forbes, “Apple iOS 15.6.1 is an important update,” because these two vulnerabilities “could be chained together to allow attackers to remotely gain full access to victims’ devices.” He, like Apple support, highly recommends applying the update as soon as possible.
To understand a little bit more about the damage that can be done by this attack, Paul Ducklin, Sophos principal research scientist, explained just how the WebKit CVE-2022-32893 flaw could ultimately allow “a booby-trapped web page” to trick Macs, iPads, and iPhones into running some dangerously unauthorized and untrusted software code. “Simply put, a cybercriminal could implant malware on your device even if all you did was view an otherwise innocent web page,” Ducklin explained to Forbes. Ducklin says even if you were to avoid using Safari, it wouldn’t help. “The vulnerability potentially affects many more apps and system components than just Apple’s own Safari browser.”
The second vulnerability could be even more lethal when it comes to your device. This one would allow an attacker, one who has already gained some control of your Apple device through the WebKit flaw, “to jump from controlling just a single app to taking over the operating system kernel itself.” As Ducklin explains it, this type of access is relegated to Apple itself, so someone with this access is like having “administrative superpowers.”
If an attacker were to be able to do this then they could spy on apps, access all the data in your device, change all of your security settings, read all your messages, and also have the ability to activate your device’s camera and mic. Apple already saw hints that the flaws that the 15.6.1 patch took care of could be used to complete a very specific and targeted attack that would allow for the installation of spyware.
“A working WebKit RCE followed by a working kernel exploit, as seen here, typically provides all the functionality needed to mount a device jailbreak (therefore deliberately bypassing almost all Apple-imposed security restrictions), or to install background spyware and keep you under comprehensive surveillance,” says Ducklin.
None of that sounds good nor wanted on any device. So, Apple device owners, whether it be an iPhone, iPod, iPad, and Mac, if your device is telling you to install this latest iOS update, you should probably install it. If not, you are taking your device’s life into your own hands and who knows what type of stuff can be added by attackers. Don’t take that chance. Download the 15.6.1 iOS update.
