Apple users are facing serious zero-days that could lay open all of their app credentials to attackers, on both Macs and iPhone/iPads.
A group of researchers from Indiana University say that they’ve found a string of vulnerabilities in OS X and iOS that, if combined, would allow an attacker to run amok on a device’s apps, stealing iCloud passwords, authentication tokens, saved web passwords on Google Chrome and more.
The flaws allow a bypass of app sandboxes and App Store security checks too: The researchers passed the vetting process to get a proof-of-concept malware approved without any alarms, that can pilfer a user’s, well, everything.
Our view is that there is still a belief that the Apple OS variants are somehow immune to malware and that vulnerabilities are exclusively a Windows issue. The reality is more a case of Windows devices simply being more widely used and therefore more widely tested/subject to vulnerability research than Apple equivalents.
This security breach emphasises the immediate requirement for better system hardening and vulnerability management across all Apple software.
Read the full article on InfoSecurity Magazine here.