Researchers have warned that a bug in Apple Inc’s iOS operating system makes most iPhones (including the iPhone 6 and 6 Plus) and iPads vulnerable to cyber attacks by hackers seeking access to sensitive data and control of their devices.
Cybersecurity firm FireEye Inc published details about the vulnerability on its blog on Monday, saying the bug enables hackers to access devices by persuading users to install malicious applications with tainted text messages, emails and Web links.
The malicious application can then be used to replace genuine, trusted apps that were installed through Apple’s App Store, including email and banking programs, with malicious software through a technique that FireEye has dubbed “Masque Attack.”
These attacks can be used to steal banking and email login credentials or other sensitive data, according to FireEye, which is well-regarded in cybersecurity circles for its research.
“It is a very powerful vulnerability and it is easy to exploit,” FireEye Senior Staff Research Scientist Tao Wei said in an interview.
Apple’s iOS has robust security features that make it extremely difficult for attackers to install malware on devices using traditional techniques for infecting Windows machines and Android mobile devices with malicious emails and Web links. The “Masque Attack” makes that possible by exploiting a system that Apple developed to allow large organizations to deploy custom-built software without going through Apple’s App Store, according to David Richardson, iOS product manager at mobile security firm Lookout.
Those applications are not vetted by Apple for malicious software, unlike apps in its App Store, though users do receive pop-up notifications asking if they want to prevent the apps from installing on devices, he said.
“You can just say ‘Don’t install.’ As long as you do that, you will be protected from this vulnerability,” Richardson said.
FireEye disclosed the vulnerability to Apple in July and representatives of the company said they were working to fix the bug, according to Wei.
Apple could not immediately be reached for comment.
News of the vulnerability began to leak out in October on specialized Web forums where security experts and hackers alike discuss information on Apple bugs, Wei said.
He said FireEye decided to go public with its findings after Palo Alto Networks Inc last week uncovered WireLurker, the first campaign to exploit the vulnerability.
“Currently WireLurker is the only one, but we will see more,” Wei said.
