Apple iOS Bug Makes Devices Vulnerable To Attack

Researchers have warned that a bug in Apple's iOS operating system makes most iPhones and iPads vulnerable to cyber attacks by hackers seeking access to sensitive data and control of their devices.

Cybersecurity firm FireEye published details about the vulnerability on its blog on Monday, saying the bug enables hackers to access devices by persuading users to install malicious applications with tainted text messages, emails and Web links.

The malicious application can then be used to replace genuine, trusted apps that were installed through Apple's App Store, including email and banking programs, with malicious software through a technique that FireEye has dubbed "Masque Attack."

These attacks can be used to steal banking and email login credentials or other sensitive data, according to FireEye, which is well-regarded in cybersecurity circles for its research.

"It is a very powerful vulnerability and it is easy to exploit," FireEye Senior Staff Research Scientist Tao Wei said in an interview.

Apple's iOS has robust security features that ....

.... read the rest of the story HERE at reuters.com.

Apple Neuters iOS 'WireLurker' Trojan

Apple has thwarted WireLurker, discovered earlier this week, 

which has been targeting iOS users both through PCs and Macs.

Apple says it has nipped the WireLurker Trojan, recently found to be targeting iOS devices, in the bud. However, it appears the threat was more widespread than was previously realised, after researchers discovered an earlier variant has been using Windows malware to attack Apple devices.

"We are aware of malicious software available from a download site aimed at users in China, and we've blocked the identified apps to prevent them from launching. As always, we recommend that users download and install software from trusted sources," said an Apple spokesperson yesterday in a statement to Business Insider.

In essence, to thwart the attack, Apple has revoked trust for a cryptographic certificate that it had previously issued to a developer.

Researchers at security firm Palo Alto exposed the WireLurker malware earlier this week, which attacks iOS devices through USB connections from infected OS X systems to hijack users' information. The malware was notable due to its ability to automatically generate malware for iOS — even if the device is not jailbroken.

WireLurker was able to install third-party applications on non-jailbroken iOS devices through a feature known as "enterprise provisioning" that relies on an enterprise certificate to create user profiles in corporate environments.

The reason it was called WireLurker is that it infects the iOS device once it's connected via USB with an infected Mac. There were 467 pieces of Mac malware that could infect iOS devices in this manner, all hosted on a third-party site in China called Maiyadi App Store.

Yesterday, it was believed that an infected Mac was the only attack vector, but security researcher Jaime Blasco from AlienVault Labs, discovered that there was in fact a Windows version too and it was being distributed prior to the Mac-only variant.

Read the rest of the story > HERE.

Credit: zdnet.com