Hacker News Reader

Comment by Silhouette | Hacker News Reader

Can anyone confirm exactly what needs to be done to temporarily disable the Apple Mail app on the latest production version of iOS (13.4.1) until this is resolved?

I've never been entirely confident in my understanding of the background processing model for iOS apps, and this attack potentially affects people I know.

View on HN

Disabling the mail feature on all the accounts configured on the phone (some accounts have multiple features like contacts, calendars, etc - those can be left enabled).

Alternatively, disable push e-mail and set the refresh interval to manually and make sure to never open the Mail app (as it could cause a manual refresh).

Thank you, but I think I'm really asking how exactly that "disabling" should be done. The UI has changed repeatedly over the years, and it's not clear to me that things like stopping the front-end app from loading, force-closing it if it's already open, or changing settings related to mail accounts would necessarily be sufficient here. Presumably deleting all of the mail accounts on any affected phone would do it, but "You just need to delete everything and then you can set it all up again later" isn't great advice to have to give to a non-techie relative if it's not necessary to go that far.

On iOS 13: Settings > Passwords & Accounts > Select each account > Disable the "Mail" slider.

Thanks. That's what we concluded as well, and having now had chance to try it, it does seem to be sufficient here.

From the founder/CEO of ZecOps twitter directly: https://twitter.com/ihackbanme/status/1252990118945681409

Q: If a user turns off mail sync for their accounts into the mail app, is that a mitigation? A: Yes. If a user is not syncing emails it would mitigate the issue.

The fact that the report mentions a daemon (maild) means that it may not be possible for an end user on a non-jailbroken device to stop activity. (For a non-Apple app, simply force-quitting by swiping up in the switcher would go 99% of the way.)

I'd guess that removing mail accounts from the device would do the job, though.

It's possible to delete the Mail app (which I had already done on my phone). I'd hope that would kill related daemons. I'm jailbroken as well so I'll check if the daemon is running later tonight.

Good point; one would hope this would do it. :)

You can turn it off under Screen Time -> Content and Privacy Restrictions -> Allowed Apps.

There's no guarantee that restricting access to the UI of the Mail app would prevent it from refreshing accounts in the background.

I was under the impression that it disables it on a deeper level since disabling Camera, for instance, disallows apps (like Snapchat) from accessing the camera even if you'd previously given Snapchat camera permissions.

Reply on news.ycombinator.com