News for hackers. Stuff that matters.

A comment on iOS 16.6.1 fixes two vulnerabilities known to be actively exploited in the wild.

Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by londons_explore on Thursday September 07, 2023 @04:32PM (#37425156)
> Apple is aware of a report that this issue may have been actively exploited.

> CVE-2023-41061: Apple

So if Apple discovered this bug, and Apple saw it exploited in the wild, the question needs to be asked... How did Apple find it in the wild? Was one of their own employees phished? Do they have monitoring on every phone to upload suspicious binaries running as root to the mothership?

[ Parent | on HN ]
Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by slama on Thursday September 07, 2023 @04:35PM (#37425187)
> Last week, while checking the device of an individual employed by a Washington DC-based civil society organization with international offices, Citizen Lab found an actively exploited zero-click vulnerability being used to deliver NSO Group’s Pegasus mercenary spyware.

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zer...

[ Parent | on HN ]
Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by tough on Thursday September 07, 2023 @04:39PM (#37425232)
Good ol pegasus they keep being on the news about spyware
[ Parent | on HN ]
Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by ronsor on Thursday September 07, 2023 @04:36PM (#37425206)
iOS can send diagnostic logs and crash reports. If the exploit crashed the app instead of running successfully, then that would likely appear in the report. Unusual stack traces can indicate RCE or other exploits.
[ Parent | on HN ]
Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by s3p on Thursday September 07, 2023 @04:40PM (#37425255)
[delayed]
[ Parent | on HN ]
Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by londons_explore on Thursday September 07, 2023 @05:12PM (#37425660)
But normally they wouldn't attribute themselves if the initial report was from an external source.
[ Parent | on HN ]
Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by hulitu on Friday September 08, 2023 @03:30AM (#37430607)
Depends on the source. If the Citizen lab didn't find it, Apple would have not patched it.
[ Parent | on HN ]
Re:iOS 16.6.1 fixes two vulnerabilities known to be actively... by acdha on Friday September 08, 2023 @09:38AM (#37433338)
iMessage passes through their servers so I would not be surprised if they look for anomalous senders or whatever other metadata isn’t encrypted, and they can correlate that with things like crash dumps or potentially other unusual activity by the recipient.
[ Parent | on HN ]