Apple Passwords App Bug Left Users Vulnerable to Phishing Attacks for Months Before Being Fixed
Apple fixed a bug in its Passwords app with December's iOS 18.2 update that had left users vulnerable to phishing attacks in the three months since the launch of iOS 18.
According to an Apple security update spotted by 9to5Mac, the Passwords app was sending unencrypted requests for the logos and icons associated with users' stored passwords.
Without protections of encryption, an attacker on the same Wi-Fi network could redirect a user's browser to a clone phishing site where login details could be stolen. The vulnerability was first discovered by developer Mysk's security researchers and reported in September.
Apple's iOS 18.2 security release notes described the bug like so:
Impact: A user in a privileged network position may be able to leak sensitive information
Description: This issue was addressed by using HTTPS when sending information over the network.
Apple lists the bug in security content updates for the Mac, iPad, and Vision Pro, indicating that this issue was fixed across multiple OSes.
Popular Stories
Apple today announced the "iPhone Duo," a new kind of iPhone featuring two screens and a foldable inner display.
The two halves of the iPhone Duo connect into a single continuous frame with the same aspect ratio across both displays, and Apple said the transition between open and closed is designed to feel fluid. When fully open, Apple says it is the thinnest iPhone ever made, with an...
Apple's "Surprise and Shine" event kicks off today at 10:00 a.m. Pacific Time, where we're expecting to see the foldable iPhone Duo, the iPhone 18 Pro and Pro Max, Apple Watch Series 12 and Ultra 4 models, new AirPods 5 earphones, and perhaps some other announcements.
Apple is providing a live video stream on its website, on YouTube, and in the company's TV app across various platforms. We...
At its event today unveiling the iPhone 18 Pro, AirPods 5, Apple Watch Series 12, and more, Apple announced that iOS 27 will be released later this month.
iOS 27 has already been available as a developer beta since June and as a public beta since July, and Apple today said that the update will be released for all users with a compatible iPhone model on Monday, September 14.
iOS 27 is...
