Archive — US — techcrunch
Apple fixes iPhone and iPad bug used in an ‘extremely sophisticated attack’
Apple released updates for iOS and iPadOS to fix a flaw that allowed disabling USB Restricted Mode on locked devices, which could have been exploited in a sophisticated attack. The vulnerability was discovered by researcher Bill Marczak and is believed to have been abused by connecting forensic tools to the devices, raising concerns about privacy and security.
Key points
- Apple released iOS 18.3.1 and iPadOS 18.3.1 updates to address a security vulnerability.
- The flaw disabled USB Restricted Mode on locked devices, possibly allowing unauthorized access to data.
- USB Restricted Mode was introduced in 2018 to enhance security by blocking USB data access on locked devices after seven days.
- The flaw was discovered by Bill Marczak from the Citizen Lab, which investigates cyberattacks.
- The exploit likely required physical access to the device and the use of forensic tools like Cellebrite or Graykey.
- There have been documented abuses of such vulnerabilities by law enforcement, particularly in targeted actions against activists.
Why it matters
- This incident highlights ongoing concerns about digital security and privacy in the face of sophisticated cyberattacks.
- The trend of law enforcement using forensic tools to access personal data without consent raises ethical and legal questions.
- Previously documented abuses, such as the December 2024 Amnesty International report on the Serbian authorities, showcase that such technology can infringe on civil rights.
The fix is crucial in safeguarding user privacy, yet the occurrence of such vulnerabilities and their exploitation by authorities underlines the need for stronger cybersecurity measures and regulations.