WWDC 2018 takes place June 4 to June 8 in San Jose, California.
iOS and OS X Security Flaws Enable Malicious Apps to Steal Passwords and Other Data
A team of six researchers from Indiana University, Georgia Tech and Peking University have published an in-depth report exposing a series of security vulnerabilities that enable sandboxed malicious apps, approved on the App Store, to gain unauthorized access to sensitive data stored in other apps, including iCloud passwords and authentication tokens, Google Chrome saved web passwords and more.
The thirteen-page research paper "Unauthorized Cross-App Resource Access on Mac OS X and iOS" details that inter-app interaction services, ranging from the Keychain and WebSocket on OS X to the URL Scheme on OS X and iOS, can be exploited to steal confidential information and passwords, including those stored in popular password vaults such as 1Password by AgileBits.
Lead researcher Luyi Xing told The Register that he reported the security flaws to Apple in October 2014 and complied with the iPhone maker's request to withhold publishing the information for six months, but has not heard back from the company since and is now exposing the zero-day vulnerabilities to the public. The flaws affect thousands of OS X apps and hundreds of iOS apps and can now be weaponized by attackers.
The thirteen-page research paper "Unauthorized Cross-App Resource Access on Mac OS X and iOS" details that inter-app interaction services, ranging from the Keychain and WebSocket on OS X to the URL Scheme on OS X and iOS, can be exploited to steal confidential information and passwords, including those stored in popular password vaults such as 1Password by AgileBits.
"We completely cracked the keychain service - used to store passwords and other credentials for different Apple apps - and sandbox containers on OS X, and also identified new weaknesses within the inter-app communication mechanisms on OS X and iOS which can be used to steal confidential data from Evernote, Facebook and other high-profile apps."The different cross-app and communication mechanism vulnerabilities discovered on iOS and OS X, identified as XARA weaknesses, include Keychain password stealing, IPC interception, scheme hijacking and container cracking. The affected apps and services include iCloud, Gmail, Google Drive, Facebook, Twitter, Chrome, 1Password, Evernote, Pushbullet, Dropbox, Instagram, WhatsApp, Pinterest, Dashlane, AnyDo, Pocket and several others.
Lead researcher Luyi Xing told The Register that he reported the security flaws to Apple in October 2014 and complied with the iPhone maker's request to withhold publishing the information for six months, but has not heard back from the company since and is now exposing the zero-day vulnerabilities to the public. The flaws affect thousands of OS X apps and hundreds of iOS apps and can now be weaponized by attackers.
[ 236 comments ]
Top Rated Comments
(View all)
39 months ago
I'm a long-time Apple user - and I've near had enough. I have no longer have faith in Apple to protect my data ... Android has had its fair share of problems too, but I just trust the engineers at Google to not let stuff like this happen.
You apparently didn't read this paper because it also mentions similar, significant issues on Android.
Security is hard.
39 months ago
Umm... "... and can now be weaponized by attackers"?? Because the he has made the knowledge of the existence of flaws public? I hope the exact nature of the flaws has been made known to Apple and hope Apple has an official response to this.
Did you read the entire article? It said Apple was told 6 months ago.
39 months ago
I don't get why this security flaws reported to Apple always seems to get the cold shoulder. Fix when El Capitan is released?
Because Federighi, though might be a great guy, is busy making funny videos for Keynotes instead of devoting time to iron out bugs and make the OS X secure. Sadly this seems to be true...
39 months ago
I'm a long-time Apple user - and I've near had enough. I have no longer have faith in Apple to protect my data. Tim Cook can ramble on about privacy all he wants, but we all know that software has never been Apple's strength. It may look pretty, but vulnerabilities like these are becoming all too common. Android has had its fair share of problems too, but I just trust the engineers at Google to not let stuff like this happen. The last major flaw I recall from Android was that random number generator that wasn't implemented correctly and allowed some bitcoin wallets to be hijacked. That was hardly as widespread as this flaw. It's so frustrating.
Apple should have fixed this issue, but I don't see the point in hyperbole: All systems have vulnerabilities and Google / Samsung / Sony / HTC / Apple are all as bad as each other. There's an article on the same website (the register) today about a flaw in the latest Samsung phones that will allow the installation of malware simply by connecting to a compromised WiFi service so it's not been a good day all round for software!
39 months ago
There is no such thing as security from this sort of thing. For every programmer that writes a security program that is supposed to keep our information secure, there is a hacker out there that can decode/hack the program to steal what ever they want.
Apple could come out with a patch today to fix the current problem, but tomorrow someone else finds a way to hack it.
There is no such thing as security.
The main point I see is Apple was given 6 months to fix this and it still exists as a vulnerability in their code base as of today. So what if they fix it today, it darn well should have been fixed 3 months ago and not required a media blasting for Apple to get it done!
39 months ago
There is no such thing as security from this sort of thing. For every programmer that writes a security program that is supposed to keep our information secure, there is a hacker out there that can decode/hack the program to steal what ever they want.
Apple could come out with a patch today to fix the current problem, but tomorrow someone else finds a way to hack it.
There is no such thing as security.
39 months ago
This is probably not get patched for a while,
It looks like Apple is too busy with the Watch!
It looks like Apple is too busy with the Watch!
39 months ago
I don't know how this is a security issue. The Keychain entry explicitly says "Allow access" for both apps.
A 3rd party sandboxed application shouldn't be able to make a keychain entry that a different application can access.[ Read All Comments ]
Apple is closing its Apple Store located in Atlantic City, New Jersey, which will affect 52 employees who currently work at the store and will need to be relocated, reports Bloomberg.
Apple has...
For this week's giveaway, we've teamed up with WaterField Designs to offer MacRumors readers a chance to win the company's Atlas Executive Athletic Holdall, a bag that's ideal for...
Apple today launched the latest sale on Beats by Dre products, including markdowns on the BeatsX, Powerbeats3, Solo3 Wireless On-Ear Headphones, and Studio3 Wireless Over-Ear Headphones. Make sure...
Twitter is testing a new "Data saver" toggle on iOS devices, as one user shared on the social media platform this morning. For users in the test, the data saver setting is housed at the very...
A special "Decade Collection" range of Beats Headphones are currently being promoted by online retail merchants ahead of scheduled availability on June 4, suggesting Apple will officially...
Apple's AirDrop feature lets you wirelessly send and receive files between nearby Macs as well as to and from local iOS devices. It's usually accessed from the sidebar of an open Finder...
Since November 2017, AT&T has offered customers the chance to get the 32GB Apple TV 4K at no extra cost when they sign up and pay for either four months or three months of DirecTV Now. Since this...
Mophie today announced the launch of the Charge Stream Travel Kit, which is a wireless charging kit that's designed for use while traveling, as the name suggests.
Designed for the iPhone X,...
