A huge security flaw has been discovered in Apple devices that could allow hackers to steal your passwords and data

A group of security researchers have discovered an alarming vulnerability in Apple's mobile and desktop operating systems.

In a newly-released paper, the research group explained how they tested a series of attacks that were able to bypass security checks, steal passwords, and even critical app data.

The vulnerability was discovered to exist on Apple devices including the iPhone, iPad, and Mac computers.

Due to the way Apple built apps to communicate with each other, the paper writes, researchers were able to "steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote."

Basically, these researchers were able to build a malware that was uploaded to Apple's App Store in the form of a typical app, which was then able to steal credentials from the existing apps on the researchers' phones. These credentials include passwords and other precious app data that's supposed to be off-limits.

The lead researcher, Luyi Xing, told the Register that his team was able to "gain unauthorized access to other apps' sensitive data such as passwords and tokens from iCloud, Mail app and all web passwords stored by Google Chrome."

According to the Register, Xing and his team informed Apple, which asked for six months to deal with issue. The six months have now passed and the vulnerabilities persist, say the researchers.

The ramifications of these findings could be huge. Very little has been written about the potential cross-app vulnerabilities in Apple's software, and this discovery shows some huge holes certainly exist.

The researchers tested this type of attack with large sample of Apple apps and found that "more than 88.6%" were completely exposed. These include extremely popular apps like password manager 1Password and Google Chrome.

"The consequences of these attacks are serious," the paper concludes, "including leak of user passwords, secrete tokens and all kinds of sensitive documents."

In short, this vulnerability could quickly become bad news for Apple if hackers or other malicious parties take advantage of the security holes, and there's no way to know if any attacks utilizing this method have already been carried out. For Apple's part, the company needs to figure out a way to patch the vulnerability across both its iOS and Mac OS X operating systems.

Business Insider has reached out to Apple, and we will update the post when we hear back.

You can watch a video showcasing how a malicious app can utilize the vulnerability to steal stored passwords from Google Chrome.

Comments

Intel announces the first 14 nanometre processor

At the Computex conference in Taipei, chipmaker Intel has revealed a fanless mobile PC reference design using the first of its next-generation 14nm "Broadwell" processors. The 2 in 1 pictured here is a 12.5" screen that is just 7.2 mm thick with keyboard detached and weighs 670 grams. The Surface Pro 3 – for comparison – is 9.1 mm thick and weighs 800 grams. It includes a media dock that provides additional cooling for a burst of performance. The next-generation chip is purpose-built for 2 in 1s and will hit the market later in 2014 . Called the Intel Core M, it will be the most energy-efficient Intel Core processor in the company's history with power usage cut by up to 45 percent, resulting in 60 percent less heat. The majority of designs based on this new chip are expected to be fanless, with up to 32 hours of battery life, offering both a lightning-fast tablet and razor-thin laptop. Intel is also delivering innovation and performance for the ...

Facebook Now Supports PGP To Send You Encrypted Emails

You can now instruct Facebook to encrypt every email it sends to you so nobody — not even the NSA — is likely to be able to read your messages anytime soon. All you have to do is import your public PGP key into your Facebook settings and you’re good to go. The problem here, of course, is that most people have no idea how public/private key email encryption works and how to even get started with it. In the wake of Edward Snowden’s leaks, a number of organizations, including Google, promised to completely hide the complexities of end-to-end email encryption from regular users. Very few of these products have materialized so far, however — not for lack of trying, but because this is actually a very complex problem, both from a technical and user experience perspective. Facebook uses the well-established PGP scheme (the GNU Privacy Guard implementation of OpenPGP, to be precise) to encrypt messages and tools lik...

Uber, Google and other tech employees form Coalition of Black Excellence

When black employee resource groups from a variety of tech companies come together, black magic happens. More specifically, black excellence happens. The Coalition of Black Excellence Week, spearheaded by Uber Litigation Counsel Angela Johnson in collaboration with black ERGs from over 40 tech companies like Facebook, Google, eBay, Lyft and Microsoft, kicks off this Monday in the San Francisco Yay (Bay) Area. The idea for CBE Week came in part from Johnson’s experiences living in Washington D.C., and being able to attend events put on by the Congressional Black Caucus, she told me at Uber’s headquarters this week. “When I moved out to the Bay Area, I really wished there were similar types of experiences for tech,” Johnson said. “And I thought if we could bring together different black ERGs, or diversity and inclusion committees, or people who were interested in some of the issues the black community is passionate about, a lot of positive change and impact could come from that....

Oculus’ New $99 Samsung Gear VR Makes Serious Virtual Reality Affordable

At half the price of its last mobile VR headset, the new $99 Oculus-made Samsung Gear VR is cheap enough to unlock virtual reality for the mainstream. Revealed today at the Oculus Connect conference, it works with the whole 2015 line of Samsung Smartphones including the Note 5, S6, S6 Edge, and S6 Edge+. It will ship in November in time for Black Friday. Compared to the $199 previous Gear VRs that only worked with fewer phones, this headset will be a lot more accessible. The new Gear VR is 22% lighter, making it more comfortable to wear. The trackpad on the temple of the headset also now has a tactile directional pad on it so your finger will know where it’s touching. The previous Gear VRs had a smooth trackpad and sometimes it was to tough to know if you were touching it or just the unsensitive shell of the headset when you couldn’t see for yourself. There’s also a new Gear VR Gamepad which all the Oculus Connect conference attendees will get for free. It features an...

Laser gun is deployed and operational on U.S. Navy warship

After several years of research and testing, the U.S. Navy has introduced a new laser gun designed to protect ships without using ammunition. Another entry on our timeline is now a reality as the U.S. Navy has authorised the first operational use of a laser weapon. This new hi-tech system – known as the Laser Weapon System (LaWS) – is designed to serve as a form of defence against drones and other small flying vehicles or small-boat enemies including suicide attackers. It is highly accurate, able to hit objects moving at up to 300 mph (480 km/h). The LaWS fires a solid-state infrared beam with two modes: high output to destroy a target, and low output for optical "dazzling", warning shots or to cripple a potential attacker. Among the advantages of this device versus projectile weapons is the low cost per shot, as each firing of the weapon requires only minimal cost for generating the energetic pulse; by contrast ordnance for projectile weapons must be des...

Exciting Technology

Search This Blog