iOS 16.6.1 fixes two vulnerabilities known to be actively exploited in the wild | Hacker News Reader

iOS 16.6.1 fixes two vulnerabilities known to be actively exploited in the wild

support.apple.com

91 pointschatmasta18 comments

> Apple is aware of a report that this issue may have been actively exploited.

> CVE-2023-41061: Apple

So if Apple discovered this bug, and Apple saw it exploited in the wild, the question needs to be asked... How did Apple find it in the wild? Was one of their own employees phished? Do they have monitoring on every phone to upload suspicious binaries running as root to the mothership?

> Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware.

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...

Good ol pegasus they keep being on the news about spyware

iOS can send diagnostic logs and crash reports. If the exploit crashed the app instead of running successfully, then that would likely appear in the report. Unusual stack traces can indicate RCE or other exploits.

I'm not sure who needs to ask that question. Apple gets critical vulnerability reports and investigates them.

But normally they wouldn't attribute themselves if the initial report was from an external source.

Depends on the source. If the Citizen lab didn't find it, Apple would have not patched it.

iMessage passes through their servers so I would not be surprised if they look for anomalous senders or whatever other metadata isn’t encrypted, and they can correlate that with things like crash dumps or potentially other unusual activity by the recipient.

What about those that are running the iOS 17 developer beta?

I also wonder. No updates yet.

Related ongoing thread:

NSO group iPhone zero-click, zero-day exploit captured in the wild - https://news.ycombinator.com/item?id=37425007 - Sept 2023 (30 comments)

Serious question, if the NSO group is actively creating spyware - how have we not sanctioned them?

Heck this would probably need to be escalated to threaten the host country of the company with consequences if they're giving safe haven to a known bad actor.

Probably because we use their tools too.

https://www.nytimes.com/2023/04/02/us/politics/nso-contract-...

We have. They’re on the “entity list” which bars US corps from supplying them. It’d be politically… difficult to say the least to sanction Israel.

In general, are these exploits in memory only? If I reboot my phone, is that likely to impact anything? Or is it usually possible to persist them to the file system?

You have secure chain of boot so you can't launch the malicious stuff on boot.

But - this doesn't prevent you once you have root to modify some app and system settings for the phone to reinfect itself eventually (proxies, vpn, who knows what)

In general they are in memory only. However, if the exploit is from iMessage parsing an image, this may happen whenever you run the app.

Regardless, persistence is hard, which is why NSA and others recommend shutting off your phone at least once per week.

After the update my iPhone suddenly complained that my iCloud storage was full although I hadn’t uploaded anything new. Kinda strange.

Reply on news.ycombinator.com