A Critical iPhone and IPad Bug That Lurked for Eight Years May be Under Active Attack

upstart writes in with an IRC submission for Bytram:

A critical iPhone and iPad bug that lurked for 8 years may be under active attack:

A critical bug that has lurked in iPhones and iPads for eight years is under active attack by sophisticated hackers who are using a zero-day exploit to hack the devices of high-profile targets, a security firm reported on Wednesday.

The exploit is triggered by sending booby-trapped emails that, in some cases, require no interaction at all and, in other cases, require only that a user open the message, researchers from ZecOps said in a post. The malicious emails allow attackers to run code in the context of the default mail apps, which make it possible to read, modify, or delete messages. The researchers suspect the attackers are combining the zero-day with a separate exploit that gives full control over the device. The vulnerability dates back to iOS 6 released in 2012. Attackers have been exploiting the bug since 2018 and possibly earlier.

"With very limited data we were able to see that at least six organizations were impacted by this vulnerability- and the full scope of abuse of this vulnerability is enormous," ZecOps researchers wrote. "We are confident that a patch must be provided for such issues with public triggers ASAP."

Targets from the six organizations include:

• Individuals from a Fortune 500 organization in North America
• An executive from a carrier in Japan
• A VIP from Germany
• Managed security services providers in Saudi Arabia and Israel
• A journalist in Europe
• Suspected: An executive from a Swiss enterprise

Apple has currently patched the flaw in the beta for iOS 13.4.5. At the time this post went live, a fix in the general release had not yet been released.

Read more of this story at SoylentNews.