Apple patches critical security flaws used to steal encrypted data

Apple products have a reputation for security, especially compared with the systemic security flaws baked into the Android update system (or lack thereof). In the world of device security, however, no one is ever perfect, and the critical flaws that Apple patched today underscore that point.

The details on how these flaws came to light are quite interesting. On August 10, UAE human rights activist Ahmed Mansoor received a text message from an unknown number offering a link described as “New secrets about torture of Emiratis in state prisons,” according to Motherboard.


 Instead of clicking on the link, Mansoor got in touch with security professionals and it’s a good thing he did. The files waiting at the end of the link Mansoor received were a sophisticated malware package that leveraged three previously unknown bugs in the iPhone.

Further investigation by Citizen Lab and Lookout indicated that the software exploits were likely written by the Israeli surveillance company NSO Group, a secretive organization that charges huge amounts of money $8 million for 300 software licenses.

This isn’t the kind of software you use for general Trojan or malware attacks it’s a sophisticated method of targeting specific people for surveillance. “It basically steals all the information on your phone, it intercepts every call, it intercepts every text message, it steals all the emails, the contacts, the FaceTime calls.

 It also basically backdoors every communications mechanism you have on the phone,” Lookout’s vice president of research, Mike Murray explained.

 “It steals all the information in the Gmail app, all the Facebook messages, all the Facebook information, your Facebook contacts, everything from Skype, WhatsApp, Viber, WeChat, Telegram you name it.”