Google researchers found a bunch of malicious sites that quietly hacked iPhones for years
- Researchers at Google's cybersecurity division Project Zero discovered a handful of websites that were being used to hack iPhones.
- Once visited, the websites would plant a "monitoring implant" on the device, which could then steal messages, photos, and real-time GPS location data.
- The hacks spanned iOS 10 through 12, which Project Zero said indicates they took place over the course of two years.
- For more stories go to www.businessinsider.co.za.
Google researchers found a handful of hacked websites that were being quietly used to infiltrate iPhones for at least the last two years.
Analysts at Google's cybersecurity division Project Zero published a deep-dive technical blog Thursday night detailing their findings.
"There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant," security researcher Ian Beer wrote in the blog. Once inside the iPhone, this implant was able to steal messages, photos, and GPS location data in real-time.
Although the blog post didn't say exactly how many of these websites they were, the researchers estimated each one received thousands of visitors a week. The hacks spanned iOS 10 through 12, which Beer said indicated a "sustained effort" to hack iPhones over a period of two years.
The websites gained access to the iPhones through five different methods or "exploit chains." The researchers found 14 separate vulnerabilities which made these exploit chains possible. Seven of these vulnerabilities were found in Safari, iPhones' default web browser.
The researchers told Apple about their findings in February, and gave the company a seven-day deadline to fix the vulnerabilities. Six days later, Apple updated the security on iOS 12. Google gave Apple a much tighter deadline than is usual in security disclosure, which the norm being 90 days to patch issues.
Generally Apple has a strong reputation when it comes to security, and earlier this month the company upped the amount of money it's willing to shell out for bug bounties - vulnerabilities found by security researchers - to $1 million.
Apple declined to comment when contacted by Business Insider.
Receive a daily email with all our latest news: click here.
Also from Business Insider South Africa:
- ‘We just take parts from grounded planes’ SA Express source says – but the airline maintains safety is not a concern
- A Tanzania jet worth R1.4 billion and closely associated with its ruling party is locked down at OR Tambo – and a lawyer says it is going nowher
- New Huawei phones in SA - and around the world - will likely not have Android
- Here’s what MSC Cruises’ new R200 million terminal in Durban will look like
- 14 world-changing innovations by women that were originally credited to men