iOS and OS X Security Flaws Enable Malicious Apps to Steal Passwords and Other Data

A team of six researchers from Indiana University, Georgia Tech and Peking University have published an in-depth report exposing a series of security vulnerabilities that enable sandboxed malicious apps, approved on the App Store, to gain unauthorized access to sensitive data stored in other apps, including iCloud passwords and authentication tokens, Google Chrome saved web passwords and more.


The thirteen-page research paper "Unauthorized Cross-App Resource Access on Mac OS X and iOS" details that inter-app interaction services, ranging from the Keychain and WebSocket on OS X to the URL Scheme on OS X and iOS, can be exploited to steal confidential information and passwords, including those stored in popular password vaults such as 1Password by AgileBits.

"We completely cracked the keychain service - used to store passwords and other credentials for different Apple apps - and sandbox containers on OS X, and also identified new weaknesses within the inter-app communication mechanisms on OS X and iOS which can be used to steal confidential data from Evernote, Facebook and other high-profile apps."

The different cross-app and communication mechanism vulnerabilities discovered on iOS and OS X, identified as XARA weaknesses, include Keychain password stealing, IPC interception, scheme hijacking and container cracking. The affected apps and services include iCloud, Gmail, Google Drive, Facebook, Twitter, Chrome, 1Password, Evernote, Pushbullet, Dropbox, Instagram, WhatsApp, Pinterest, Dashlane, AnyDo, Pocket and several others.


Lead researcher Luyi Xing told The Register that he reported the security flaws to Apple in October 2014 and complied with the iPhone maker's request to withhold publishing the information for six months, but has not heard back from the company since and is now exposing the zero-day vulnerabilities to the public. The flaws affect thousands of OS X apps and hundreds of iOS apps and can now be weaponized by attackers.

Top Rated Comments

Westside guy Avatar
108 months ago
I'm a long-time Apple user - and I've near had enough. I have no longer have faith in Apple to protect my data ... Android has had its fair share of problems too, but I just trust the engineers at Google to not let stuff like this happen.
You apparently didn't read this paper because it also mentions similar, significant issues on Android.

Security is hard.
Score: 24 Votes (Like | Disagree)
Craiger Avatar
108 months ago
Umm... "... and can now be weaponized by attackers"?? Because the he has made the knowledge of the existence of flaws public? I hope the exact nature of the flaws has been made known to Apple and hope Apple has an official response to this.
Did you read the entire article? It said Apple was told 6 months ago.
Score: 24 Votes (Like | Disagree)
ViktorEvil Avatar
108 months ago
6 months should be plenty of time to fix this. Not good Apple, not good :(
Score: 18 Votes (Like | Disagree)
Alenore Avatar
108 months ago
OSX is the new Windows ;)
Score: 18 Votes (Like | Disagree)
TheTissot11 Avatar
108 months ago
I don't get why this security flaws reported to Apple always seems to get the cold shoulder. Fix when El Capitan is released?
Because Federighi, though might be a great guy, is busy making funny videos for Keynotes instead of devoting time to iron out bugs and make the OS X secure. Sadly this seems to be true...
Score: 17 Votes (Like | Disagree)
Phil A. Avatar
108 months ago
I'm a long-time Apple user - and I've near had enough. I have no longer have faith in Apple to protect my data. Tim Cook can ramble on about privacy all he wants, but we all know that software has never been Apple's strength. It may look pretty, but vulnerabilities like these are becoming all too common. Android has had its fair share of problems too, but I just trust the engineers at Google to not let stuff like this happen. The last major flaw I recall from Android was that random number generator that wasn't implemented correctly and allowed some bitcoin wallets to be hijacked. That was hardly as widespread as this flaw. It's so frustrating.
Apple should have fixed this issue, but I don't see the point in hyperbole: All systems have vulnerabilities and Google / Samsung / Sony / HTC / Apple are all as bad as each other. There's an article on the same website (the register) today about a flaw in the latest Samsung phones that will allow the installation of malware simply by connecting to a compromised WiFi service so it's not been a good day all round for software!
Score: 16 Votes (Like | Disagree)

Popular Stories

Multi Display CarPlay 1

All-New Apple CarPlay Launching Later This Year With These 5 New Features

Friday September 29, 2023 11:29 am PDT by
At WWDC 2022 last year, Apple previewed the next generation of CarPlay, promising deeper integration with vehicle functions like A/C and FM radio, support for multiple displays across the dashboard, personalization options, and more. Apple said the first vehicles with support for the next-generation CarPlay experience would be announced in late 2023, but it has still not shared any additional...
iPhone 15 Pro lineup

Apple to Address iPhone 15 Pro Overheating Issue With iOS 17 Update

Saturday September 30, 2023 9:28 am PDT by
Apple plans to release an iOS 17 update to address a bug that may contribute to the reported iPhone 15 Pro and iPhone 15 Pro Max overheating issue, according to a statement the company shared today with MacRumors and Forbes reporter David Phelan. Apple also says some recent updates to third-party apps have overloaded the system and contributed to the overheating issue. The report notes that...
iphone se 4 modified flag edges

iPhone SE 4 Details: Action Button, USB-C Port, Face ID, and More

Wednesday September 27, 2023 1:34 pm PDT by
Significant changes are expected to arrive with Apple's fourth-generation iPhone SE, in terms of both design and hardware, MacRumors has learned. The iPhone SE 4, known internally under the codename Ghost, is expected to receive a new design derived almost entirely from the base model iPhone 14. According to our sources, the iPhone SE 4 will use a modified version of the iPhone 14 chassis...
BMW Logo iPhone 15 Pro

Warning: BMW Wireless Charging May Break iPhone 15's Apple Pay Chip

Sunday October 1, 2023 6:14 am PDT by
If you have an iPhone 15 and drive a BMW, it might be best to avoid charging the device with the vehicle's wireless charging pad for now. Over the past week, some BMW owners have complained that their iPhone 15's NFC chip no longer works after charging the device with their vehicle's wireless charging pad, according to comments shared on the MacRumors Forums and X, formerly known as Twitter. ...
iPhone 16 Side Feature

iPhone 16 and 16 Pro: Preliminary Weights and Dimensions

Friday September 29, 2023 12:34 pm PDT by
MacRumors has obtained preliminary information on the weights and dimensions planned for the iPhone 16, iPhone 16 Plus, iPhone 16 Pro, and iPhone 16 Pro Max. The information corroborates previous reports suggesting that the iPhone 16 Pro and 16 Pro Max will feature larger displays. iPhone 16 and 16 Plus Current information suggests that the iPhone 16 and 16 Plus will maintain the same...
CarPlay SharePlay

CarPlay Not Working for Some iPhone 15 Users, Possibly Because of USB-C Cables

Friday September 29, 2023 2:27 pm PDT by
CarPlay is not working as expected for some iPhone 15 users, an issue that is likely linked to the transition to USB-C. There are multiple complaints from MacRumors readers and Reddit users who are unable to get CarPlay to work with their new devices. Cable type and available port options are a common theme in the CarPlay reports, with many of the functionality problems linked to USB-A to...
iPhone 15 USB C Port Keynote

Some USB-C Power Banks Fail to Work With iPhone 15

Thursday September 28, 2023 2:06 pm PDT by
Apple added a USB-C port to the iPhone 15 lineup this year, allowing it to work with USB-C cables, USB-C power banks, and more. It turns out that some USB-C battery packs are not working properly with Apple's iPhone 15, resulting in charging issues. As highlighted on Reddit and the MacRumors forums, not all existing USB-C power banks can be used with the iPhone 15 models, perhaps due to the...