Vulnerabilities - Apple Alerts Users on Outdated iPhones

What Happened

Apple has taken a proactive step to protect its users by sending Lock Screen notifications to iPhones and iPads running older versions of iOS and iPadOS. This alert informs users about active web-based attacks targeting outdated software. The notifications serve as a reminder to install critical updates to safeguard their devices. This initiative follows the discovery of new exploit kits, including Coruna and DarkSword, which have been used by cybercriminals to deliver malicious payloads through compromised websites.

The alerts come in the wake of a support document released by Apple, urging users to update their devices. The company has acknowledged the existence of attacks specifically targeting older iOS versions, emphasizing the importance of keeping software up to date to prevent exploitation. The notification states, "Apple is aware of attacks targeting out-of-date iOS software, including the version on your iPhone. Install this critical update to protect your iPhone."

Who's Affected

The vulnerabilities primarily affect users running iOS versions between 13.0 and 17.2.1 for Coruna, and between 18.4 and 18.7 for DarkSword. This means that a significant number of iPhone and iPad users could be at risk if they have not updated their devices. The presence of these exploit kits indicates that threat actors are actively seeking to exploit outdated systems, making it crucial for users to heed Apple's warnings.

Recent reports suggest that various threat actors, motivated by different objectives, have been leveraging these kits to execute their attacks. As these exploits become more accessible, the potential for mass exploitation increases, heightening the risk for users who fail to update their devices.

What Data Was Exposed

While specific data breaches have not been reported, the existence of these exploit kits poses a serious threat to user data. The Coruna exploit kit is noted for being an evolution of previous frameworks used in sophisticated campaigns, such as Operation Triangulation, which targeted iPhones through zero-click iMessage exploits. This evolution suggests that the current threat landscape is more advanced, potentially allowing for broader access to user data.

The emergence of these kits raises concerns about the democratization of such exploits, which were once reserved for nation-states. As they become more widely available, the risk of widespread attacks on iPhones and iPads increases, turning them into larger attack surfaces than before.

What You Should Do

If you are using an outdated version of iOS or iPadOS, the most critical action is to install the latest updates as soon as possible. If your device cannot be updated to a supported version, consider enabling Lockdown Mode. This feature, available on devices running iOS 16 and later, provides an additional layer of protection against malicious web content.

Apple has stated that they are not aware of any successful mercenary spyware attacks against devices with Lockdown Mode enabled. By taking these precautions, users can significantly reduce their risk of falling victim to these active web-based exploits. Stay vigilant and keep your devices updated to ensure your personal data remains secure.