A new vulnerability might have just been found in Apple iPhones. Security researchers have claimed that the default iOS Mail app suffers from a severe security flaw and is vulnerable to attacks from hackers.
According to a report from ZecOps, the vulnerability is already being exploited “in the wild” and that it is an advanced threat that Apple is unaware of. The research agency believes that at least 6 high profile targets have been exploited so far, including a Japanese mobile carrier executive and other “individuals from a Fortune 500 company in North America.”
ZecOps have refrained from mentioning names stating privacy reasons but said that it was unable to obtain the malicious code since the emails were remotely deleted by hackers. The firm believes that the vulnerability is related to 2 zero-day iOS exploits that have existed in the Mail app since at least iOS 6, which was launched back in 2012.
Editor’s Pick: Realme X50m 5G launched with 120Hz display, SD765G, 30W charging and 48MP quad cameras for 1,999 Yuan (~$282)
According to ZecOps, “the attack’s scope consists of sending a specially crafted email to a victim’s mailbox enabling it to trigger the vulnerability in the context of iOS MobileMail application on iOS 12 or mailed on iOS 13.” However, the method to reproduce this vulnerability has failed so far by various other researchers. This includes Jann Horn and Maddie Stone from Google’s Project Zero cybersecurity program.
@ZecOps your writeup says "The suspicious events included strings commonly used by hackers (e.g. 414141…4141).", but that's also what it looks like when you just base64-encode nullbytes; and this is MIME parsing, so you're likely to see base64-encoded data
— Jann Horn (@tehjh) April 22, 2020
Notably, Apple was reached out from Beijing News reported in China to verify the report from ZecOps, regarding the vulnerability the iOS mail app faces on iPhones. Unfortunately, Apple China declined to comment on the situation so we have no official confirmation. Other researchers are currently asking ZecOps to provide more details on how to recreate the vulnerability to actually prove the security flaw’s existence.
UP NEXT: Huawei to soon launch headphones and smart eyewear powered by the Kirin A1 chip: Report
