A group of Google researchers has discovered that thousands of iOS users every week have been subject to an unprecedented hacking operation. In a blog posted by security researcher Ian Beer, part of Google’s Project Zero, the company revealed a wide-ranging campaign of iPhone hacking via a small collection of websites. The hacked sites were being used in indiscriminate “watering hole” attacks against their visitors, said Beer, adding that the sites were programmed to assess devices that loaded them, and to compromise them with powerful monitoring malware if possible.
Project Zero found that almost every version from iOS 10 through to the latest version of iOS 12 was affected by the operation, run by a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years. Once installed, the malware could monitor GPS location data in real time, or be harnessed to snatch photos, contacts, passwords and other sensitive information from the iOS Keychain.
A total of 14 bugs were exploited for the iOS attack across five different “exploit chains”, said Google, adding that it had reported the security issues to Apple on 01 February. Apple subsequently released an iOS update (iOS 12.1.4) that fixed the flaws on 07 February.
