Kaspersky – Latest Apple News

Apple’s App Store pulls apps with hidden screen reading malware

tigaman webdesign — Fri, 07 Feb 2025 15:01:51 +0000

Kaspersky revealed details about the new “SparkCat” malware affecting a handful of iOS apps on Wednesday, leading to Apple promptly removing the compromised apps from the App Store following the report.

Juli Clover for MacRumors:
‎

Some of the apps that had hidden malware included ComeCome, WeTink, and AnyGPT. 11 apps were removed in total, but when removing the apps, Apple found another 89 with the same code that had been previously rejected or removed from the ‌App Store‌ for violating Apple’s fraud policies. When an app is removed for fraud, Apple terminates the associated developer account.

As outlined by Kaspersky, the apps used a malicious framework with OCR capabilities designed to suss out sensitive information in images and screenshots stored on iPhones. Recovery phrases for crypto wallets were a specific target, with attackers aiming to steal bitcoin and other cryptocurrency, but the malware could target other phrases like passwords.

Apple’s default settings prevent apps from accessing a user’s photos without explicit permission. If granted access to the Photo Library, these apps could scan images for specific phrases set by the attackers. Any image containing a targeted phrase would then be uploaded to a remote server. Kaspersky’s investigation suggests this malware primarily targeted iOS users in Europe and Asia.
‎
MacDailyNews Note: To control access to your photos on iPhone and iPad:

Go to Settings > Privacy & Security.
Tap Photos.
A list appears showing the apps that requested access. You can turn access on or off or select Limited Access for any app on the list.

To control access to your photos on Mac:

Choose Apple menu > System Settings, then click Privacy & Security in the sidebar. (You may need to scroll down.)
Click Photos.
Turn access to your photos on or off for each app in the list.

For some apps, you can click Options to give full access to all your photos, access to only photos you select, or only the ability to add photos.

We are currently about 1/4th of the way to being sustainable with Substack subscriptions.

Please tell your Apple-loving friends about MacDailyNews on Substack and, if you’re currently a free subscriber, please consider $5/mo. or $50/year to keep MacDailyNews going. Just hit the subscribe button. Thank you!

Read on Substack

‎
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!

Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.

The post Apple’s App Store pulls apps with hidden screen reading malware appeared first on MacDailyNews.

Researchers find photo-scanning malware on Apple’s App Store for the first time

tigaman webdesign — Thu, 06 Feb 2025 18:02:17 +0000

Kaspersky researchers have uncovered malware apps on Google’s Play Store and, for the first time, on Apple’s App Store that harbor a malicious framework aimed at stealing crypto wallet recovery phrases. These phrases are crucial for accessing cryptocurrency in digital wallets. Dubbed “SparkCat” by researchers, this malware is thought to have been in circulation since March 2024.

Jake Peterson for LifeHacker:
‎

If you downloaded one of these apps on either iOS or Android, the app would likely ask permission to access your photo library, then the malicious framework would launch an optical character recognition (OCR) plug-in to scan and identify text in your images. If the program found text that matched certain keywords, it would then send those images to a remote server. The idea here is to scan your library looking for screenshots that reveal the recovery phrases in your crypto wallet and send them back to the thieves who could then use those phrases to break in and steal from accounts.

One of the first apps to arouse suspicious of Kaspersky researchers was a Chinese food delivery app called ComeCome. It’s still available on both iOS and Android, and is the first known app infected with OCR malware to appear on Apple’s App Store, according to Kaspersky.

‎
MacDailyNews Note: More info about SparkCat via Kaspersky here.

We are currently about 1/4th of the way to being sustainable with Substack subscriptions.

Read on Substack

‎
Please help support MacDailyNews — and enjoy subscriber-only articles, comments, chat, and more — by subscribing to our Substack: macdailynews.substack.com. Thank you!

Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.

The post Researchers find photo-scanning malware on Apple’s App Store for the first time appeared first on MacDailyNews.

If you haven’t updated your Apple devices this week, go do it now

tigaman webdesign — Fri, 23 Jun 2023 15:58:01 +0000

Macworld

All attention might be on iOS 17 and macOS Sonoma, but Apple hasn’t stopped working on its current crop of operating systems. And if you’re not running the betas, you need to know that Apple just shipped a slew of updates to fix some critical security holes.

In all, Apple pushed 10 updates on Wednesday: iOS 16.5.1 and iPadOS 16.5.1; iOS 15.7.7 and iPadOS 15.7.7; macOS Ventura 13.4.1, macOS Monterey 12.6.7, and macOS Big Sur 11.7.8; Safari 16.5.1; and watchOS 9.5.2 and watchOS 8.8.1. That covers more than a decade of devices going back to 2013 and includes the iPhone 6s, Apple Watch Series 3, and the original 12-inch MacBook.

All of the OS updates fix the same vulnerability:

Kernel

Impact: An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Description: An integer overflow was addressed with improved input validation.
CVE-2023-32434: Georgy Kucherin (@kucher1n), Leonid Bezvershenko (@bzvr_), and Boris Larin (@oct0xor) of Kaspersky

According to The Register and Hacker News, this update fixes the flaw exploited by the “Operation Triangulation” campaign that was able to use iMessage to deliver a “malicious attachment” that then transmitted sensitive information including audio recordings, photos, and geolocation data. The exploit, dubbed TriangleDB is known to have been exploited in versions of iOS earlier than 15.7, but the flaw can be found in all of Apple’s devices.

Additionally, the iOS, iPadOS, and macOS Ventura updates, as well as Safari 16.5.1 for Big Sur and Monterey, include a fix for a WebKit flaw that also may have been exploited:

WebKit

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A type confusion issue was addressed with improved checks.
CVE-2023-32439: an anonymous researcher (WebKit Bugzilla: 256567)

None of the updates include any other security patches. However, the iOS 16.5.1 release notes say it includes a fix for an issue that prevents charging with the Lightning to USB 3 Camera Adapter.

iOS, MacOS

If you’re reading this on an Apple device, go update it right now

tigaman webdesign — Thu, 22 Jun 2023 10:30:00 +0000

Macworld

All told, Apple pushed eight updates on Wednesday: iOS 16.5.1 and iPadOS 16.5.1; iOS 15.7.7 and iPadOS 15.7.7; macOS Ventura 13.4.1, macOS Monterey 12.6.7, and macOS Big Sur 11.7.8; and watchOS 9.5.2 and watchOS 8.8.1. That covers more than a decade of devices going back to 2013 and includes the iPhone 6s, Apple Watch Series 3, and the original 12-inch MacBook. All of the updates fix the same vulnerability:

Kernel

Impact: An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Description: An integer overflow was addressed with improved input validation.
CVE-2023-32434: Georgy Kucherin (@kucher1n), Leonid Bezvershenko (@bzvr_), and Boris Larin (@oct0xor) of Kaspersky

According to The Register, this update fixes the flaw exploited by the “Operation Triangulation” campaign that was able to use iMessage to deliver a “malicious attachment” transmitting sensitive information including audio recordings, photos, and geolocation data. The exploit is known to have been exploited in versions of iOS earlier than 15.7, but the flaw can be found in all of Apple’s devices.

Additionally, the iOS, iPadOS, and macOS Ventura updates include a fix for a WebKit flaw that also may have been exploited:

WebKit

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A type confusion issue was addressed with improved checks.
CVE-2023-32439: an anonymous researcher (WebKit Bugzilla: 256567)

None of the updates include any other security patches. However, the iOS 16.5.1 release notes say it includes a fix for an issue that prevents charging with the Lightning to USB 3 Camera Adapter.

iOS, MacOS

Apple releases macOS Ventura 13.4.1 update with critical security fixes

tigaman webdesign — Wed, 21 Jun 2023 19:23:23 +0000

Macworld

Apple on Wednesday released macOS Ventura 13.4.1, an update that includes a couple of critical zero-day security patches. The release notes merely state that the update includes “important security fixes and is recommended for all users.”

It’s unclear whether this update includes any other fixes, but Apple has recently promised that a fix would be coming to correct a storage issue with the new Mac Pro. According to the security notes, the update includes the same two security patches as the iOS 16.5.1 update:

Kernel

Impact: An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Description: An integer overflow was addressed with improved input validation.
CVE-2023-32434: Georgy Kucherin (@kucher1n), Leonid Bezvershenko (@bzvr_), and Boris Larin (@oct0xor) of Kaspersky

WebKit

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A type confusion issue was addressed with improved checks.
CVE-2023-32439: an anonymous researcher

While the details for kernel patch include an issue that has been exploited on iPhones, it’s still important to apply the fix in macOS. So it’s a good idea to install the update as soon as possible. For older Macs, there are also updates to macOS Monterey (12.6.7) and macOS Big Sur (11.7.8) that address the kernel issue.

How to install macOS Ventura 13.4.1

An internet connection is required to install the update, and the Mac needs to restart. To install macOS Ventura 13.4.1:

Click on the Apple menu and select System Settings.
Select General in the left sidebar.
Select Software Update in the main section of the window.
The Mac will check online for any available updates. If the update is available, a description will appear. Click on the Update Now button to start the installation. The update will download to your Mac and the installer will run. The Mac will need to restart to complete the installation.

Check out our macOS Ventura guide for more information. Also, Apple has similar security patches for the iPhone and iPad.

MacOS

iOS 16.5.1 is released with important security updates and a Camera Adapter fix

tigaman webdesign — Wed, 21 Jun 2023 18:36:20 +0000

Macworld

Apple has released a minor operating system update in the form of iOS 16.5.1 and iPadOS 16.5.1. As is typical with an x.x.1 point release, the list of changes is very small. The release notes consist of two sentences:

This update provides important security fixes and is recommended for all users. It also fixes an issue that prevents charging with the Lightning to USB 3 Camera Adapter.

That second bit is good news for people who rely on the Lightning to USB 3 Camera Adapter (and charge while using it), but it’s the first sentence that matters most here. The two security updates in this release are substantial:

Kernel

Impact: An app may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.
Description: An integer overflow was addressed with improved input validation.
CVE-2023-32434: Georgy Kucherin (@kucher1n), Leonid Bezvershenko (@bzvr_), and Boris Larin (@oct0xor) of Kaspersky

WebKit

Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Apple is aware of a report that this issue may have been actively exploited.
Description: A type confusion issue was addressed with improved checks.
CVE-2023-32439: an anonymous researcher

Apple says it is aware of a report that both of these flaws may have been actively exploited (though the kernel one is specifically against versions of iOS released before iOS 15.7). That’s bad news, and you should get the fix right away.

For those with iPhones that are too old to run iOS 16 (older than iPhone 8) or iPadOS 16 (older than 3rd gen iPad Air or 5th gen iPad), Apple has released iOS and iPadOS 15.7.7 to address the same security flaws.

To get the update, open the Settings app, tap General, then Software Update. Then tap Download and Install and follow the prompts.

iOS

Zero-click iOS malware attack via iMessage infects iPhones running iOS 15.7 and earlier – Kaspersky

tigaman webdesign — Fri, 02 Jun 2023 19:00:47 +0000

Antivirus provider Kaspersky has discovered a malware campaign targeting iPhones running up to iOS 15.7 via iMessage. Importantly, this zero-click/tap malware can be found and blocked.

Kaspersky:

ince it is impossible to inspect modern iOS devices from the inside, we created offline backups of the devices in question, inspected them using the Mobile Verification Toolkit’s mvt-ios and discovered traces of compromise.

We are calling this campaign “Operation Triangulation”, and all the related information we have on it will be collected on the Operation Triangulation page.

This allowed [us] to move the research forward, and to reconstruct the general infection sequence:

• The target iOS device receives a message via the iMessage service, with an attachment containing an exploit.
• Without any user interaction, the message triggers a vulnerability that leads to code execution.
• The code within the exploit downloads several subsequent stages from the C&C server, that include additional exploits for privilege escalation.
• After successful exploitation, a final payload is downloaded from the C&C server, that is a fully-featured APT platform.
• The initial message and the exploit in the attachment is deleted

The malicious toolset does not support persistence, most likely due to the limitations of the OS. The timelines of multiple devices indicate that they may be reinfected after rebooting. The oldest traces of infection that we discovered happened in 2019. As of the time of writing in June 2023, the attack is ongoing, and the most recent version of the devices successfully targeted is iOS 15.7.

The analysis of the final payload is not finished yet. The code is run with root privileges, implements a set of commands for collecting system and user information, and can run arbitrary code downloaded as plugin modules from the C&C server.

It is important to note, that, although the malware includes portions of code dedicated specifically to clear the traces of compromise, it is possible to reliably identify if the device was compromised. Furthermore, if a new device was set up by migrating user data from an older device, the iTunes backup of that device will contain the traces of compromise that happened to both devices, with correct timestamps.

MacDailyNews Take: In the full blog post, Kaspersky has a somewhat technical way to identify and strip to malware from backups, but, if your device allows, update to iOS 16.5 (released May 18, 2023) ASAP.

Please help support MacDailyNews. Click or tap here to support our independent tech blog. Thank you!

Support MacDailyNews at no extra cost to you by using this link to shop at Amazon.

The post Zero-click iOS malware attack via iMessage infects iPhones running iOS 15.7 and earlier – Kaspersky appeared first on MacDailyNews.

Report details ‘zero-click’ iOS exploit that can infect an iPhone via iMessage

tigaman webdesign — Fri, 02 Jun 2023 16:30:01 +0000

Macworld

Digital security firm Kaspersky has posted information about a recent cyberattack that targeted the iPhones of Kaspersky employees, which were infected with spyware that is part of a campaign the company dubbed, “Operation Triangulation.”

Hackers were able to infect the iPhones using what Kaspersky called an “invisible iMessage with a malicious attachment” that can be activated without user interaction. Once installed, Triangulation was able to gather sensitive information (audio recordings, photos, geolocation, and more) and transmit that data to remote servers. All of this can occur without the user being able to notice.

In a separate, more technical post, Kaspersky points out that “the most recent version of the devices successfully targeted is iOS 15.7.” An Apple representative told Ars Technica that “there’s no indication in Kaspersky’s account that any of the exploits work on iOS versions later than 15.7.” A Kaspersky representative told Ars Technica that one of the iOS vulnerabilities was recorded as CVE-2022-46690 in the CVE.report database, which Apple fixed in iOS 16.2, according to Apple’s security notes.

Kaspersky was able to detect Triangulation with its Unified Monitoring and Analysis Platform. The company also said, “Due to the closed nature of iOS, there are no (and cannot be any) standard operating-system tools for detecting and removing this spyware on infected smartphones.” If an iPhone has had its ability to update iOS disabled, this could be an indirect indicator of a Triangulation infection.

Kaspersky has created a free utility to check an iPhone backup for a Triangulation infection. The company has full instructions on downloading and using its triangle_check utility for Mac, Linux, and Windows. The utility is a Python package, not a typical Mac app, and Mac users will need to use macOS’s Terminal app and install a pip utility in order to use Kaspersky’s tool.

iPhone viruses and malware are rare, but no device is completely invulnerable. Apple urges users to update to the most recent version of IOS that a device can support in order to ensure that the latest security patches are installed. Learn more about iPhones and viruses, and check out our guide on how to remove a virus from and iPhone or iPad.

Antivirus, iOS, Security

Zero-click iOS malware attack through iMessage is actively infecting iPhones

tigaman webdesign — Thu, 01 Jun 2023 18:27:37 +0000

Antivirus provider Kaspersky has discovered a malware campaign explicitly aimed at infecting iPhones running up to iOS 15.7 through iMessage — but it can be found and prevented.

iOS devices have been specifically targeted with malware

Kaspersky’s team identified potentially suspicious behavior emanating from multiple iOS devices. However, due to the security limitations that restrict direct internal examination of iOS devices, the company had to generate offline backups.

Zero-click iOS malware attack through iMessage is actively infecting iPhones

tigaman webdesign — Thu, 01 Jun 2023 18:27:37 +0000

Antivirus provider Kaspersky has discovered a malware campaign explicitly aimed at infecting iPhones running up to iOS 15.7 through iMessage — but it can be found and prevented.

iOS devices have been specifically targeted with malware