“BLASTPASS” bug can install malware without user interaction.
Wow that’s extremely bad, has Android had anything like that?
edit: lmao nvm they just did https://securityaffairs.com/150440/hacking/september-2023-android-security-updates-0day.html?amp=1
And don’t forget the 18 zero days, including 4 for RCE, found around WiFi calling that had them suggesting everyone turn it off for a few months.
Stagefright was a BIG thing several years ago
Iirc the NSO Group wouldn’t be a globally known spyware corp if not.
This is the best summary I could come up with:
The iOS 16.6.1, iPadOS 16.6.1, macOS 13.5.2, and watchOS 9.6.2 updates patch the flaws across all of Apple’s platforms.
The CVE-2023-41064 and CVE-2023-41061 flaws were reported by the Citizen Lab at the Munk School of Global Affairs & Public Policy at the University of Toronto.
Also dubbed “BLASTPASS,” Citizen Lab says that the bugs are serious because they can be exploited just by loading an image or attachment, which happens regularly in Safari, Messages, WhatsApp, and other first- and third-party apps.
Citizen Lab also said that the BLASTPASS bug was “being used to deliver NSO Group’s Pegasus mercenary spyware,” the latest in a long line of similar exploits that have been used to infect fully patched iOS and Android devices.
Users worried about these kinds of flaws can mitigate them proactively by enabling Lockdown Mode on their iOS and macOS devices; among other things, it blocks many attachment types and disables link previews, the kinds of attack vectors that attackers can use to exploit these “clickless” vulnerabilities.
“We believe, and Apple’s Security Engineering and Architecture team has confirmed to us, that Lockdown Mode blocks this particular attack,” Citizen Lab said.
The original article contains 287 words, the summary contains 190 words. Saved 34%. I’m a bot and I’m open source!
Daily reminder to use Lockdown Mode, folks. Nothing of value is lost in activating and using it.
Edit: turns out the flaw is exploited by way of an attachment that LM stops from loading. So in this case, LM would save you.
Doesn’t the article contradict what you just said?
“We believe, and Apple’s Security Engineering and Architecture team has confirmed to us, that Lockdown Mode blocks this particular attack,” Citizen Lab said.
Edited. Still a sledgehammer approach imo.
Apparently it’s Apple specific and the android “Lockdown mode” just disables all phone unlock methods (face detection, fingerprint…) other than the main one (pin, pattern…) until the next unlock.
Still good to be aware of in case you’re likely to be arrested or something.
deleted by creator
The most likely issue you’ll encounter is that it blocks almost all message attachment types, so if someone texts you an image, PDF, contact card, etc, it will completely block the attachment.
holy shit. Somehow I didn’t know about that. Thank you!
Hmmm - no patches available for IOS 17 public beta yet
