Web application security specialists have reported the finding of a new vulnerability in Apple’s new operating system iOS 13 beta version which, if exploited, gives threat actors full access to passwords, email addresses and any login data stored by the ‘Auto Fill’ system feature.
Because this version of the operating system is still in testing stages, the vulnerability scope is really limited, affecting only the participating users of the public test of this beta version.
According to web application security experts, the vulnerability provides hackers with access to all data stored in iCloud Keychain, Apple’s password management system, from which the ‘Auto Fill’ feature gets the information. To obtain the information, attackers simply must:
- Go to Settings
- Choose the Passwords and Accounts option
- Repeatedly tap in Website and Apps Passwords option
Doing so, the hacker will cancel the message from the Face ID/Touch ID security system, and after further attempts, they will gain access to all usernames and passwords stored on the system; finally, the threat actor can even make modifications to the compromised access credentials.
It is important to note that exploiting the vulnerability requires physical access to an unlocked iPhone or iPad, so the complexity of the attack increases considerably, web application security specialists say. The company has already been notified of the existence of this flaw, so it is highly likely that the company will fix this flaw in the next beta version of the iOS 13 and iPad OS 13.
Specialists from the International Institute of Cyber Security (IICS) mention that this version of the operating system includes multiple improvements and new features to enhance the privacy experience for Apple users.
While the error is serious, as it exposes a large amount of sensitive information, the company is in time to implement the necessary measures to fix this and other bugs that are discovered by users of the iOS 13 beta.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
