Security Bits Logo no alpha channel

Security Bits — 3 May 2020

Feedback & Followups

🧯 Deep Dive — The iOS Mail Bug

TL;DR — don’t panic, there is no immediate danger, and a patch is on the way 🙂

Security researchers found a pair of bugs in Apple’s Mail app on iOS that would cause the app to crash when trying to load a maliciously crafted mail. Importantly, the bugs can’t be used to actually exploit a device without being paired with other bugs in an exploit chain. This makes the bugs useful building-blocks for an attacker, but not a problem in isolation. Basically — Apple’s multi-layered security system is doing what it should and protecting us all from this bug!

The security researchers claimed they had evidence that the bug was being actively exploited in the wild, but on further inspection those claims seem very suspect. Perhaps the most charitable thing you could say is that they are circumstantial at best. The emails they found could be evidence of failed attempted exploits, or, they could be perfectly normal MIME-encoded data, a given that MIME is used to send email attachments, that definitely seems the more likely explanation to me 🙂

Apple have also responded to the claims stating they can find no evidence of these bugs every having been exploited in the wild, and pointing out that the bugs can’t be used to exploit an iPhone directly.

The bugs have been patched in the latest iOS betas.

Links

❗ Action Alerts

Worthy Warnings

Notable News

Top Tips

Excellent Explainers

Just Because it’s Cool 😎

Palate Cleansers

Legend

When the textual description of a link is part of the link it is the title of the page being linked to, when the text describing a link is not part of the link it is a description written by Bart.

Emoji Meaning
🎧 A link to audio content, probably a podcast.
A call to action.
flag The story is particularly relevant to people living in a specific country, or, the organisation the story is about is affiliated with the government of a specific country.
📊 A link to graphical content, probably a chart, graph, or diagram.
🧯 A story that has been over-hyped in the media, or, “no need to light your hair on fire” 🙂
💵 A link to an article behind a paywall.
📌 A pinned story, i.e. one to keep an eye on that’s likely to develop into something significant in the future.
🎩 A tip of the hat to thank a member of the community for bringing the story to our attention.

Leave a Reply

Your email address will not be published.

Scroll to top