It's time to upgrade your Apple mobile devices. Quickly, go and do it now and come back to read why afterwards.
If you are not running Apple iOS 9.3.5 or later on your iPhone, iPod or iPad you should want to add an upgrade to your to do list in the very near future.
Apple work very hard to build security in to their mobile operating system. That's why when the Cupertino giant released iOS 9.3.5 in August 2016 to fix not one but three zero-day vulnerabilities the tech-news feeds went haywire. If you missed it let us know in the comments below. iOS 9.3.5 was released only a matter of weeks after 9.3.4 as Apple's security team worked quickly to plug the holes which were found in the wild only 10 days before thanks to the quick thinking of a likely target of the exploits from the United Arab Emirates.
The security vulnerability researchers involved (from Citizen Lab and Lookout) suspect the vulnerabilities may have been known to the initial finders as far back as iOS 7 (2013). Citizen Lab have called out Israeli company NSO Group as the developers of Pegasus which is thought to be the name of the software within which the exploits can be launched.
While it may seem unlikely that you would become a target of such an underground and probably extraordinarily expensive hacking tool, unless you have ties to government, extreme wealth or a multinational company with high value intellectual property, now that the vulnerabilities have been announced they are more likely to be researched widely by a larger security research base, including organisations who profit from crime. The fact is that these are zero-day vulnerabilities which by definition were unknown (other than by presumably the NSO Group, and their clients) and un-patched until now.
In the case of the UAE target the story goes that social engineering or phishing attempt was made through a message to his or her mobile phone. The unknown sender left the recipient suspicious so they passed it on to Citizen Lab to investigate. Had they unwittingly followed the link they would have opened a pathway to all the data and communication from their phone to be viewed by an unknown party. This includes communciation from applications such as WeChat, Facebook Messenger, Skype, WhatsApp, Viber, Gmail, Apple's iMessage and more.
The rest is history, yet we now live in a world where this is the future. Cyber crime and espionage is the new norm - with governments and criminals playing the same game. Of course money and power are at the centre of it all...
In 2015 a privately held cyber-security research company Zerodium offered to pay $1 million for information about a Zero Day Bug in Apple's iOS 9. The reason Zerodium is forking out so much for information on these bugs is because it then on-sells that information, including "protective measures and security recommendations, to its clients". The clients are touted as Government and Corporate, yet only a "limited number of organisations" will have access to the solutions and capabilities - which likely drives up the price due to exclusivity.
So, it's time to patch your devices and stay alert. If you manage a network or part of a networks infrastructure may this also be a timely reminder to check through your security best practices and policies, change default settings and always read the release notes of the software upgrades and fixes for your hardware.
Have you updated yet?
A couple of years ago I played around with some Mac OS X clients and a packet analyser in an attempt to gain a better understanding of what was going on between the clients when using AirDrop. I was intrigued to see if there was any interaction with local wireless infrastructure. We had been receiving assistance requests from School IT Teams regarding wireless performance where they attributed the issue to student use of AirDrop. So I took a peek at packets and frames to see if I could uncover anything that might be useful from a vendor level to better co- or inter-operate with AirDrop.
I was surprised by how efficient the data transfer was. Inter device file sharing seemed so smooth and transfers were fast. Should I have been so surprised? Of course cutting out an AP (or a hop in a single duplex network) will improve performance.
Apple’s laser focus on end user experience bypassed the thought that vendors might struggle with the concept of co-inhabiting an airspace where clients have direct wireless interaction. The implementation of AirDrop was relatively user friendly and has only improved with the integration with iOS devices. It’s this user centric vision that lead me to my next thought...
We build and optimise networks. Continuous learning is our secret to being good. Along the learning journey we will share things here...