Read on for more information and resources for protecting yourself and your devices.
Apple has advised users of iPhone, iPad, and Mac hardware to update their software as soon as possible to protect against vulnerabilities that may grant an attacker complete control of these devices.
These security flaws affect iOS, iPadOS, and macOS Monterey devices. Apple has stated that “An application may be able to execute arbitrary code with kernel privileges” which may grant an attacker complete control of the affected device. Because of the significant impact of these exploits, Drawbridge recommends that users of these devices update their software immediately.
How to Protect Yourself:
- Update iOS and iPad OS to versions 15.6.1
- Update macOS Monterey 12 to 12.5.1
- If you’re running macOS 10 Big Sur or mac OS 11 Catalina, update to Safari 15.6.1 and keep an eye out for future OS updates
- Details on updating your iOS devices can be found HERE
Technical Details:
Attackers may be able to exploit these vulnerabilities by tricking someone into accessing a web page which hosts malicious code. They can then leverage these vulnerabilities to execute this code on the victim’s device with kernel level privileges, which means that the attacker can run this code with unrestricted access rights. Relevant CVEs have been outlined below:
- CVE-2022-32893: A site hosting malicious content can trick iPhones, iPads and Macs into running unauthorized and untrusted software code.
- CVE-2022-32894: An attacker who has exploited the above vulnerability will be able to leverage CVE-2022-32894 to take over the operating system kernel, gaining administrative control of the device.
General Best Practices & References:
- Ensure devices are updated regularly.
- Avoid suspicious websites
- Follow the principle of least privilege when assigning permissions to accounts on macOS devices running older operating systems
