Photo credit: www.engadget.com

Apple Patches USB Security Flaw in Latest Update

Apple has recently released updates for iOS and iPadOS, specifically versions 18.3.1, to address a severe security vulnerability. This flaw in USB Restricted Mode could potentially allow an attacker to disable this security feature, which has been in place for nearly seven years. The company’s release notes indicate that the vulnerability “may have been exploited in an extremely sophisticated attack against specific targeted individuals.”

The release documentation provides details on the nature of the flaw, characterizing it as a vulnerability that could enable “a physical attack.” This means that an attacker would need direct access to the device to exploit the weakness. Therefore, users should not be overly alarmed unless they have reason to believe they are targets of highly skilled attackers.

USB Restricted Mode, which was introduced with iOS 11.4.1, is designed to prevent unauthorized USB accessories from accessing data on a device that remains locked for over an hour. This feature is particularly relevant for safeguarding iPhones and iPads against tools used by law enforcement, such as Cellebrite and Graykey. It explains the prompts that ask users to unlock their devices prior to connecting to a Mac or Windows PC.

In line with its protocol of maintaining privacy, Apple has not disclosed specifics about the identified attacks or the entities that may have employed this vulnerability. They have acknowledged being “aware of a report that this issue may have been exploited.” The flaw was brought to light by security expert Bill Marczak from the University of Toronto’s Citizen Lab. Marczak has a notable history in cybersecurity, having previously uncovered the first recognized zero-day remote jailbreak for iPhones in 2016, which was subsequently marketed to governmental entities by a cyberwarfare firm.

To verify the activation of USB Restricted Mode, users can navigate to Settings > Face ID (or Touch ID) & Passcode. Within this menu, users should scroll to “Accessories” and check that the toggle is off, as the default setting keeps this feature enabled. It’s important to note that toggling the setting off indicates that the security feature is actually on, due to the list’s orientation towards allowed access.

To install the latest security update, users should go to Settings > General > Software Update on their iPhone or iPad.

Source
www.engadget.com