Apple Mail on iOS has two severe "zero-click" flaws

The eight-year-old vulnerabilities can be triggered by cyber criminals on iOS 13 without any user action

The Mail app on Apple’s flagship iOS operating system has been afflicted with two serious vulnerabilities that can allow a hacker to attack a device by sending emails that consume significant levels of memory.

Hackers have triggered two vulnerabilities in the Mail app, which have existed since iOS 6 was released in 2012, giving them the power to leak, modify or delete emails, according to findings by ZecOps. In addition, the flaws have been exploited in combination with another as-of-yet unidentified bug to gain full device access.

To initiate the attack, one would send an email message designed to cause a buffer overflow in the Mail app, which means the hacker can fill a block of memory beyond its capacity. These content of these emails, once sent, can then be deleted.

The receipt of an email triggers the code paths for both vulnerabilities, the first known as OOB Write and the second dubbed Remote Heap Overflow. When exploited in the wild, ZecOps researchers believe the OOB Write flaw was accidentally triggered while hackers were aiming to trigger the Remote Heap Overflow.

All iOS versions are vulnerable, including the Mail app on iOS 13.4.1, although the researchers haven’t been able to test versions prior to iOS 6. MacOS is not vulnerable to either flaw.

The vulnerability can be triggered remotely on iOS 13 when the Mail application is opened in the background. For iPhone users still on iOS 12, meanwhile, the attack requires a click on the email. If the hacker controls the email server, however, the attack can be triggered in a zero-click fashion in a similar way to how it’d be conducted on devices running iOS 13. 

Researchers have identified several targets as having been attacked using the mechanism, including individuals from a Fortune 500 business in the US, a European journalist, and MSSPs from Saudi Arabia and Israel.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

ZecOps began tracking the attacks being triggered from January 2018 on a device running iOS 11.2.2, with the same threat operators likely abusing the vulnerabilities now. It’s possible, moreover, that the attackers were using the vulnerabilities even earlier.

Following a routine iOS security probe, researchers found a number of suspicious events affecting the default Mail app. Following analysis, ZecOps discovered the exploitable vulnerability affecting iPhones and iPads, as well as multiple triggers in the wild, with targets including enterprise users, VIPs, and MSSPs over a prolonged period of time.

ZecOps reported the issue to Apple on 19 February, with the developer patching both flaws in a publicly available beta between 15 and 16 April. 

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Recommended

Apple to send exec to App Store Senate hearing after initially declining
Policy & legislation

Apple to send exec to App Store Senate hearing after initially declining

12 Apr 2021
Apple set to launch new iPad Pro models this month despite supply issues
Business strategy

Apple set to launch new iPad Pro models this month despite supply issues

12 Apr 2021
Epic files complaint against Apple with UK's competition watchdog
Policy & legislation

Epic files complaint against Apple with UK's competition watchdog

31 Mar 2021
Apple's online-only WWDC 2021 will kick off on 7 June
operating systems

Apple's online-only WWDC 2021 will kick off on 7 June

30 Mar 2021

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021