Apple's iOS 14.8 Update Fixes Zero-Click Exploit Used to Distribute Pegasus Spyware

[PinkyMacGodess]

Apple seemingly want this update to just "be there". Probably the reason there was no beta.

Because it was an easy fix? Some of these 'zero days', and other security flaws are from oversights by programmers and insufficient testing. Fixing some are almost as easy as 'dotting the 'i''. Does there need to be a prolonged beta testing regimen for a simple fix? Especially when it pisses off a known PITA? I love it actually... 'Take this, ******s!!!'

Love it, love it, love it...

 

[timeislove]

Should I wait a little longer as I suppose the new iOS 15 would incoprate this security fix?

 

[PinkyMacGodess]

The ultimate solution in security:

Actually wouldn't the 'ultimate solution in (computer) security' be that it's in a locked brick vault, and the operator only talks to people through a phone, and nothing comes in, or goes out except printed paper?

I had a client that thought they 'had the tiger by the tail'. Their CAD systems, and server, weren't connected to the internet, but every USB drive they used was at one point. (Oh, and no antivirus, because stupid works like that?)

Yeah, their server got SLAMMED!!! All their files were corrupted, and they weren't doing backups, (because, again, stupid) because apparently they lived in a fantasy world that had gaping holes in it...

 

[PinkyMacGodess]

Should I wait a little longer as I suppose the new iOS 15 would incoprate this security fix?

HAH!!! Don't assume anything. It's possible, and I'd hope, but Microsoft, back 'in the day', would release updates to their OS, and it would NOT include a patch from the previous version. Oh, and some patches would undo previous fixes. Yes, that was the joy of using Microsoft NT4. Those issues didn't happen often, but they did happen. DOH!!!

 

[haruhiko]

Should I wait a little longer as I suppose the new iOS 15 would incoprate this security fix?

Given how small the update is for iOS 15 except the photo text thing… I think you’d better upgrade to 14.8 first.

 

[BootsWalking]

Good thing Apple protects us from the dangers of third-party payment systems, otherwise we might be vulnerable to something worse than a zero-click full-system exploit like this.

 

[Schtibbie]

Should I wait a little longer as I suppose the new iOS 15 would incoprate this security fix?

Wait for what? Are you paying per download? Per bit? I have never understood posts like this. Install. The. Thing. Are you accomplishing something by “holding off”? Waiting for the next version you will likely ALSO hold off on? Do you enjoy micromanaging your OS version?

 

[ender78]

You know that Apple has offices in Israel right?

I was not sure about the current status of offices in Israel and what teams may reside there. I did know that Johny Srouji their VP of hardware is from Haifa.

 

[PhillyGuy72]

Oh...nice surprise actually. I had no idea this was out until I came on the site, no reason to think there was another update until 15 (I assume that's coming on Friday).

Thanks!
Updating now.

 

[ender78]

Reminds me of apple unwilling to outcompete government or institutions payments to security researchers choosing To notify apple security bugs before selling them off.

What is a fair price, $1, $100,000, $1,000,000 , $50,000,000, 10 Trillion ?

Exploits are the new arms race.

What prevents the same person from collecting $1,000,000 from Apple and at the same time selling the exploit to 10 others?

 

[PinkyMacGodess]

Good thing Apple protects us from the dangers of third-party payment systems, otherwise we might be vulnerable to something worse than a zero-click full-system exploit like this.

Cheap shot...

 

[Shirasaki]

What is a fair price, $1, $100,000, $1,000,000 , $50,000,000, 10 Trillion ?

Exploits are the new arms race.

What prevents the same person from collecting $1,000,000 from Apple and at the same time selling the exploit to 10 others?

Or those “security researchers” sell all of those exploits to governments etc leaving apple and general public in the dark, then we may have a fully compromised system. What cost do Apple need to pay for a safer system?

You know it’s an arms race, yet sacrifice nothing to outcompete the adversaries?

 

[Viper2005]

Does this update also fix the cellular data issue from 14.7.1?

 

[PinkyMacGodess]

Or those “security researchers” sell all of those exploits to governments etc leaving apple and general public in the dark, then we may have a fully compromised system. What cost do Apple need to pay for a safer system?

You know it’s an arms race, yet sacrifice nothing to outcompete the adversaries?

And yet there are 'hackers' out there that will turn over info on 'zero days' for the good of everyone. Sure, they wouldn't turn down money, a bounty, but they also believe that everyone benefits when holes are fixed.

That was probably why I was so completely horrified to hear that the various 'three letter agencies' in this country were covertly expoiting those zero days and not reporting their existence to the involved parties. Imagine OUR government, exploiting zero day holes, against US?!?! 'With friends like that', huh?

And finding out some of those same agencies were developing their own 'tools', and cooperating with somewhat nefarious groups that dealt in such things? OUR government agencies should be helping secure OUR computers and computing devices, not hiding tools that they are using, and they know others are using too. At some point, if there are no more secrets, except for the victims, we are ALL victims...

 

[smarch]

And yet there are 'hackers' out there that will turn over info on 'zero days' for the good of everyone. Sure, they wouldn't turn down money, a bounty, but they also believe that everyone benefits when holes are fixed.

That was probably why I was so completely horrified to hear that the various 'three letter agencies' in this country were covertly expoiting those zero days and not reporting their existence to the involved parties. Imagine OUR government, exploiting zero day holes, against US?!?! 'With friends like that', huh?

And finding out some of those same agencies were developing their own 'tools', and cooperating with somewhat nefarious groups that dealt in such things? OUR government agencies should be helping secure OUR computers and computing devices, not hiding tools that they are using, and they know others are using too. At some point, if there are no more secrets, except for the victims, we are ALL victims...

everything is a play at this point. 100%. It’s time we realize.

 

[AndiG]

That is really good news. But everyone should stop cheering. A tremendous amount of bugs was found in iOS within the last years, even the traders stopped buying zero day exploits. NSO could have some other exploits as a fallback solution to hack iOS.

 

[0924487]

Why did apple not start on this back in July?

Because they needed to know where to look. If they already knew, then there wouldn’t be a vulnerability to begin with.

 

[ian87w]

Apple: iMessage is our main tent pole in keeping people on iPhones. So let other security researchers look for bugs and let organizations exploits it. We'll just fix it once somebody tells us there's something wrong.

 

[ian87w]

At least these nasties get patched on *every* supported iOS device on day one.

Android users, good luck.

I agree and disagree at the same time.

In terms of monthly security patches, yes, Android OEMs, other than Samsung flagships and Google, sucks. Google can do better, as right now, they only require OEMs to give quarterly security updates for 2 years at minimum to get certification. Obviously everybody is doing the bare minimum, or even less, especially the Chinese OEMs (where some of them have been caught faking security patches, only changing the text without actually pushing the patch. It shows how lazy these OEMs are).

At the same time, Android has evolved and been compartmentalized that users are still protected. Let's say there's a security issue on Google Messages app. It's available via the Play Store, so it can be updated by Google anytime for as long as Google wants, even after the phone itself stops getting OS updates. Same with the Chrome browser, Google Maps, etc. This is in contrast with Apple where everything is monolithic. You will only get Safari updates part of iOS updates.

Also, there's Play Services. This allows Google to push updates and features to even old Android devices. Take Nearby Share, Android's version of Airdrop. It's a new feature announced in 2020, but it is supported way down to Android 6 devices thanks to Play Services.

I agree that I wish Android can be more proactive in pushing the monthly security patches. At the same time, the challenges have forced Google to innovate by compartmentalizing Android piece by piece that some part of it can be updated independently from the OEMs/carriers.

 

[5232152]

Reading the technical analysis makes you wonder how the hell they came up with this.
Glad they found it, but what an impressive piece of development. No wonder they are paid in the hundred of millions.

 

[polyphenol]

Question, how urgent do I need to download this update? From my understanding, a PDF download is what triggers this exploit? So if I have not downloaded and opened a PDF file from a dodgy website, I should be fine, is that how it works?

Im just confused because I have only been using my phone to visit social media, firefox, and a few trusted apps, and nothing else.

Drat. I just typed a website address wrongly and accidentally went to some weird site and a PDF just like downloaded itself...

It only took a few minutes to go from start of download to being applied. Why delay at all? You could have initiated the download faster than typing your response. And by the time you have checked for further comments a couple of times, your device would have been updated.

Obviously, some people will be in circumstances which make it awkward or expensive (paying by the byte for downloads).

 

[bluecoast]

For the first time ever, I won’t be updating my iPhone to the latest and greatest version of iOS this fall.

iOS 15 seems as stable as iOS 11/13 did at this point (not a compliment).

I can see SharePlay being ripe for being hacked, for example (yes I know it’s not coming in the 15.0 release).

I want Apple to pause and to really step back and take time fix the errors that they have riddled through iOS (by all accounts) and only work on minor easy to implement ‘quality of life’ new features.

At this point in iOS’s maturity, adding new features to iOS seems to be mostly so Apple has something to say at WWDC (the Safari redesign that absolutely no-one was asking for, for example).

And it’s the new emojis in x.1 that cause most major version upgrades, anyhow (is my understanding).

So perhaps the WWDC keynote could go back to being more developer focussed & we can get proper reworking of key layers in iOS & numerous misc bug fixes.

Then everyone is a winner - except for Apple’s marketing dept 🙄.

 

[audiophilosophy]

Shame on Apple for employing people who created software code that would allow such a profound exploit to occur in the first place. Makes me wonder if there may be some double agents within Apple’s software team.

 

[DCIFRTHS]

If a phone has already been targeted/infected, and a new OS is installed, does anyone know if the installer removes the nefarious code? If not, is the user stuck with a compromised phone, but just protected against the latest zero day exploit?

 

[markiv810]

And for even more security...

View attachment 1830564

Perfect Solution