For a long time, Apple's strong point and one of its strong arguments, the security of the iPhone is a little bad lately. Google's Project Zero security experts discovered that a hacking operation had targeted Apple smartphones for at least two years. It has been several weeks since they continue to raise loopholes in the products of the Cupertino company, after highlighting that allowing theft of data via the Messages app.
It was enough for the user to surf on some websites for malicious software to install on his iPhone and access photos, messages and files, geolocation, email and other data. On their blog, Google experts say that these sites – which they do not give names but which were frequented by thousands of visitors each week – were initially hacked and then hosted attack software without their knowledge. "A simple visit to one of the hacked sites was enough for the operating server to attack your device, and, if successful, install a monitoring program," said Ian Beer, a member of Project Zero.
Even messages on encrypted services like WhatsApp or Telegram could be downloaded. Hangouts, Google's instant messaging, or services like Gmail and Maps, did not resist data piracy.
The malware has deliberately targeted the iPhone after discovering vulnerabilities, including the browser Safari, specific to iOS. This allowed, once the software embedded in the iPhone, to transmit more easily the data every 60 seconds. The keychain containing the passwords could also be accessible. But the damage of the software was also very easy, although involuntarily. Once the iPhone turned off and restarted, it was indeed deleted.
Several hundreds of millions of iPhones, in France and around the world, running under the iOS 10 operating system (launched in September 2016) and the following, have been hacked. Apple was warned by Google's cell last February and quickly rolled out an iOS 12.1 patch.
According to experts, however, there is no way for iPhone users to know if the malware could be installed on their device and steal information, or if a type of user was particularly targeted. "Given the sheer volume of stolen information, hackers could still maintain persistent access to various accounts and services by using stolen authentication tokens of the keychain, even after losing access to the device," Ian said. Beer. The information has also been transferred to the server without being encrypted, adds Project Zero. They can therefore always be used.
Bad news for Apple as the company has announced the presentation of its next iPhone for Tuesday, September 10 (to follow live on our site). Big improvements around security are also expected in iOS 13, the next iPhone operating system to be launched at the same time.