A huge security flaw has been discovered in Apple devices that could allow hackers to steal your passwords and data

A group of security researchers have discovered an alarming vulnerability in Apple's mobile and desktop operating systems.

In a newly-released paper, the research group explained how they tested a series of attacks that were able to bypass security checks, steal passwords, and even critical app data.

The vulnerability was discovered to exist on Apple devices including the iPhone, iPad, and Mac computers.

Due to the way Apple built apps to communicate with each other, the paper writes, researchers were able to "steal such confidential information as the passwords for iCloud, email and bank, and the secret token of Evernote."

Basically, these researchers were able to build a malware that was uploaded to Apple's App Store in the form of a typical app, which was then able to steal credentials from the existing apps on the researchers' phones. These credentials include passwords and other precious app data that's supposed to be off-limits.

The lead researcher, Luyi Xing, told the Register that his team was able to "gain unauthorized access to other apps' sensitive data such as passwords and tokens from iCloud, Mail app and all web passwords stored by Google Chrome."

According to the Register, Xing and his team informed Apple, which asked for six months to deal with issue. The six months have now passed and the vulnerabilities persist, say the researchers.

The ramifications of these findings could be huge. Very little has been written about the potential cross-app vulnerabilities in Apple's software, and this discovery shows some huge holes certainly exist.

The researchers tested this type of attack with large sample of Apple apps and found that "more than 88.6%" were completely exposed. These include extremely popular apps like password manager 1Password and Google Chrome.

"The consequences of these attacks are serious," the paper concludes, "including leak of user passwords, secrete tokens and all kinds of sensitive documents."

In short, this vulnerability could quickly become bad news for Apple if hackers or other malicious parties take advantage of the security holes, and there's no way to know if any attacks utilizing this method have already been carried out. For Apple's part, the company needs to figure out a way to patch the vulnerability across both its iOS and Mac OS X operating systems.

Business Insider has reached out to Apple, and we will update the post when we hear back.

You can watch a video showcasing how a malicious app can utilize the vulnerability to steal stored passwords from Google Chrome.

Comments

How ad-free subscriptions could solve Facebook

At the core of Facebook’s “well-being” problem is that its business is directly coupled with total time spent on its apps. The more hours you pass on the social network, the more ads you see and click, the more money it earns. That puts its plan to make using Facebook healthier at odds with its finances, restricting how far it’s willing to go to protect us from the harms of over use. The advertising-supported model comes with some big benefits, though. Facebook CEO Mark Zuckerberg has repeatedly said that “We will always keep Facebook a free service for everyone.” Ads lets Facebook remain free for those who don’t want to pay, and more importantly, for those around the world who couldn’t afford to. Ads pay for Facebook to keep the lights on, research and develop new technologies, and profit handsomely in a way that attracts top talent and further investment. More affluent users with more buying power in markets like the US, UK, and Canada command higher ad prices, effectively...

The CC Aurora is actually pretty fun, as far as projectors go

I don’t review projectors. Projectors are boring. Even the good ones. They remind me of vacation slideshows and the film strips we had to watch in health class — neither of which I’m in a particular hurry to revisit in my adult life. That said, I’ve always harbored some germ of a notion that some day I might buy one, to compensate for being one of those weirdos without a TV set. There’s something undeniably appealing about a big screen TV you can break out during movie night and then stash back into the closest of your one-bedroom New York City apartment. XGIMI’s CC Aurora is the closest I’ve seen to fitting the bill — or, for that matter, being a projector that I could actually muster any reasonable amount of excitement about. From the looks of it, it’s kind of the perfect package for the apartment dweller: it’s compact, self-contained with a built-in speaker system and plays nicely with mobile devices. Clearly I’m not alone here, either. The product scored $170,000 on Indi...

Hundreds Of Apps Banned From App Store For Accessing Users’ Personal Information

Hundreds of iOS applications have been pulled out of the App Store, following a report from analytics service SourceDNA , which uncovered a group of applications that were extracting users’ personally identifiable information, including email addresses associated with their Apple IDs, devices and peripheral serial numbers, as well as a list of apps installed on their phone. The applications in question had been using an SDK from a Chinese advertising company called Youmi which was accessing this information by way of private APIs, the report found. Nearly all of the developers were located in China so, for now, this appears to be an isolated incident. However, the larger concern here has to do with how long this activity had been taking place – and what that means in terms of Apple’s App Store review process, given that it hadn’t caught this suspect activity until being alerted to it by a third party. According to SourceDNA, Yo...

Cityscoot raises $50 million for its European electric scooter service

French startup Cityscoot announced a $50 million round of financing yesterday (€40 million). RATP Capital Innovation and Inventure Partners are leading the round, with existing investors Caisse des Dépôts and LeasePlan also participating. Cityscoot operates an electric scooter-sharing service in Paris and plans to expand to other cities in France and Europe. You can now find around 1,600 scooters in Paris or some cities next to Paris. With your phone, you book a scooter in a few seconds and type a code on the scooter to unlock it. When you’re done, you just have to park the scooter and end the ride. And if you live in Paris, chances are you’ve seen countless Cityscoots over the past year or so. They’re completely silent and they come with a helmet in the storage space under the seat. While Cityscoot is leasing its scooters, it’s a capital-intensive industry. For instance, Cityscoot’s (electric) cars change the batteries when they’re about to die so that they don’t have to ...

Uber, Google and other tech employees form Coalition of Black Excellence

When black employee resource groups from a variety of tech companies come together, black magic happens. More specifically, black excellence happens. The Coalition of Black Excellence Week, spearheaded by Uber Litigation Counsel Angela Johnson in collaboration with black ERGs from over 40 tech companies like Facebook, Google, eBay, Lyft and Microsoft, kicks off this Monday in the San Francisco Yay (Bay) Area. The idea for CBE Week came in part from Johnson’s experiences living in Washington D.C., and being able to attend events put on by the Congressional Black Caucus, she told me at Uber’s headquarters this week. “When I moved out to the Bay Area, I really wished there were similar types of experiences for tech,” Johnson said. “And I thought if we could bring together different black ERGs, or diversity and inclusion committees, or people who were interested in some of the issues the black community is passionate about, a lot of positive change and impact could come from that....

Exciting Technology

Search This Blog