Forest Global Training Partners

Cyber Risks · Krebs on Security

Critical Flaws in Apple, Samsung Devices

Summary: Researchers from Indiana University, Peking University and Georgia Institute of Technology found a zero-day flaw in iOS and OS X that lets an App Store-approved app reach other apps' Keychain data and steal iCloud, email, bank and Evernote credentials; their test apps were approved in January 2015, Apple was notified in October 2014, and more than 88 percent of apps were described as completely exposed. Separately, NowSecure disclosed that the Swift keyboard component pre-installed on more than 600 million Samsung devices, including the Galaxy S6, runs as the system user and can be exploited over a compromised network to access GPS, camera and microphone, install apps, and read messages and calls; Samsung said it had sent a patch to carriers for Android 4.2 and newer.

Why it matters: The Samsung fix went to carriers, and NowSecure said it was unknown whether those carriers had passed it to devices, leaving an unknown number of the 600 million affected phones exposed. On the Apple side, the researchers' malicious apps cleared App Store review, so the store's approval was not the barrier users assume it is.

Read the original at Krebs on Security ↗

Topics
Vulnerabilities & Patching
Related