A huge security flaw has been discovered in Apple devices that could allow hackers to steal your passwords and data

A group of security researchers have discovered an alarming vulnerability in Apple's mobile and desktop operating systems.

In a newly-released paper, the research group explained how they tested a series of attacks that were able to bypass security checks, steal passwords, and even critical app data.

The vulnerability was discovered to exist on Apple devices including the iPhone, iPad, and Mac computers.

Due to the way Apple built apps to communicate with each other, the paper writes, researchers were able to "steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote."

Basically, these researchers were able to build a malware that was uploaded to Apple's App Store in the form of a typical app, which was then able to steal credentials from the existing apps on the researchers' phones. These credentials include passwords and other precious app data that's supposed to be off-limits.

The lead researcher, Luyi Xing, told the Register that his team was able to "gain unauthorized access to other apps' sensitive data such as passwords and tokens from iCloud, Mail app and all web passwords stored by Google Chrome."

According to the Register, Xing and his team informed Apple, which asked for six months to deal with issue. The six months have now passed and the vulnerabilities persist, say the researchers.

The ramifications of these findings could be huge. Very little has been written about the potential cross-app vulnerabilities in Apple's software, and this discovery shows some huge holes certainly exist.

The researchers tested this type of attack with large sample of Apple apps and found that "more than 88.6%" were completely exposed. These include extremely popular apps like password manager 1Password and Google Chrome.

"The consequences of these attacks are serious," the paper concludes, "including leak of user passwords, secrete tokens and all kinds of sensitive documents."

In short, this vulnerability could quickly become bad news for Apple if hackers or other malicious parties take advantage of the security holes, and there's no way to know if any attacks utilizing this method have already been carried out. For Apple's part, the company needs to figure out a way to patch the vulnerability across both its iOS and Mac OS X operating systems.

Business Insider has reached out to Apple, and we will update the post when we hear back.

You can watch a video showcasing how a malicious app can utilize the vulnerability to steal stored passwords from Google Chrome.

Comments

How to prevent Recent and Phone Favorite contacts from showing in your iOS task switcher

When you double-click your iPhone's home button, you will be greeted with the task switching screen, which presents you with card deck-style snapshots of your active apps to freely browse and switch to. With iOS 8, however, where most iPhones are at the moment, Apple introduced a Favorites row there, with circular pictures of your most recently used contacts. Most people aren't bothered by their recent contacts appearing there, but for some this means easy snooping on who they've called or texted last, or simply unnecessary clutter. If you don't want to wait until iOS 9 hits and gets rid of these circular shenanigans in your task switcher, here's what you need to do to get rid of them: 1. Go to the Settings app, and scroll down to the Mail, Contacts, Calendars section; 2. From Mail, Contacts, Calendars, look for the Contacts section, which will be hosting the Show in App Switcher options; 3. Tap on Show in App Switche...

Laser gun is deployed and operational on U.S. Navy warship

After several years of research and testing, the U.S. Navy has introduced a new laser gun designed to protect ships without using ammunition. Another entry on our timeline is now a reality as the U.S. Navy has authorised the first operational use of a laser weapon. This new hi-tech system – known as the Laser Weapon System (LaWS) – is designed to serve as a form of defence against drones and other small flying vehicles or small-boat enemies including suicide attackers. It is highly accurate, able to hit objects moving at up to 300 mph (480 km/h). The LaWS fires a solid-state infrared beam with two modes: high output to destroy a target, and low output for optical "dazzling", warning shots or to cripple a potential attacker. Among the advantages of this device versus projectile weapons is the low cost per shot, as each firing of the weapon requires only minimal cost for generating the energetic pulse; by contrast ordnance for projectile weapons must be des...

Metaio’s Thermal Touch Gets A Little Bit Smaller At MWC 2015

We first reported on Metaio’s Thermal Touch concept for Augmented Reality interaction last spring. Still in its infancy, the concept relies on thermal imaging cameras to track residual heat your body leaves on surfaces that it touches. Metaio’s software can track these heat signatures so they act as “clicks” or “touches” in Augmented Reality interfaces that only the user sees on interactive eyewear or devices. It’s a pretty interesting concept and will undoubtedly open a new realm for User Experience and User Interface experts to ponder. The first prototype we looked at was crude and completely impractical—an iPad with a giant thermal camera attached to it. Indeed, a few people pointed out to me “why would you need to touch external surfaces, when the iPad screen is right in front of you?” However that question totally misses the point of the prototype, which was really just proving the concept was worth further exploration. This next concept for thermal touc...

Intel announces the first 14 nanometre processor

At the Computex conference in Taipei, chipmaker Intel has revealed a fanless mobile PC reference design using the first of its next-generation 14nm "Broadwell" processors. The 2 in 1 pictured here is a 12.5" screen that is just 7.2 mm thick with keyboard detached and weighs 670 grams. The Surface Pro 3 – for comparison – is 9.1 mm thick and weighs 800 grams. It includes a media dock that provides additional cooling for a burst of performance. The next-generation chip is purpose-built for 2 in 1s and will hit the market later in 2014 . Called the Intel Core M, it will be the most energy-efficient Intel Core processor in the company's history with power usage cut by up to 45 percent, resulting in 60 percent less heat. The majority of designs based on this new chip are expected to be fanless, with up to 32 hours of battery life, offering both a lightning-fast tablet and razor-thin laptop. Intel is also delivering innovation and performance for the ...

Oculus’ New $99 Samsung Gear VR Makes Serious Virtual Reality Affordable

At half the price of its last mobile VR headset, the new $99 Oculus-made Samsung Gear VR is cheap enough to unlock virtual reality for the mainstream. Revealed today at the Oculus Connect conference, it works with the whole 2015 line of Samsung Smartphones including the Note 5, S6, S6 Edge, and S6 Edge+. It will ship in November in time for Black Friday. Compared to the $199 previous Gear VRs that only worked with fewer phones, this headset will be a lot more accessible. The new Gear VR is 22% lighter, making it more comfortable to wear. The trackpad on the temple of the headset also now has a tactile directional pad on it so your finger will know where it’s touching. The previous Gear VRs had a smooth trackpad and sometimes it was to tough to know if you were touching it or just the unsensitive shell of the headset when you couldn’t see for yourself. There’s also a new Gear VR Gamepad which all the Oculus Connect conference attendees will get for free. It features an...

Exciting Technology

Search This Blog