Researchers have warned that a bug in Apple Inc’s iOS operating system makes most iPhones and iPads vulnerable to cyber attacks by hackers seeking access to sensitive data and control of their devices.
Cybersecurity firm FireEye Inc published details about the vulnerability on its blog on Monday, saying the bug enables hackers to access devices by persuading users to install malicious applications with tainted text messages, emails and Web links.
The malicious application can then be used to replace genuine, trusted apps that were installed through Apple’s App Store, including email and banking programs, with malicious software through a technique that FireEye has dubbed “Masque Attack.”
These attacks can be used to steal banking and email login credentials or other sensitive data, according to FireEye, which is well-regarded in cybersecurity circles for its research.
“It is a very powerful vulnerability and it is easy to exploit,” FireEye Senior Staff Research Scientist Tao Wei said in an interview.
Apple’s iOS has robust security features that make it extremely difficult for attackers to install malware on devices using traditional techniques for infecting Windows machines and Android mobile devices with malicious emails and Web links. The “Masque Attack” makes that possible by exploiting a system that Apple developed to allow large organizations to deploy custom-built software without going through Apple’s App Store, according to David Richardson, iOS product manager at mobile security firm Lookout.
Those applications are not vetted by Apple for malicious software, unlike apps in its App Store, though users do receive pop-up notifications asking if they want to prevent the apps from installing on devices, he said. “You can just say ‘Don’t install.’ As long as you do that, you will be protected from this vulnerability,” Richardson said.
