Hacked websites were infecting iPhones
Google Project Zero found sites that silently attacked every iPhone visitor for two years. Keep iOS updated.
Google’s Project Zero published details last week of a campaign that used a small set of hacked websites to attack every iPhone that visited them. Just opening the page was enough. The attackers used five exploit chains covering iOS 10 to 12, over at least two years.
The implant could read messages, photos, contacts and location, and send them out. It didn’t survive a restart, but visiting the site again reinfected the phone.
Apple fixed the last of these bugs in February, in iOS 12.1.4.
What this means:
- “iPhones don’t get hacked” is a myth. They’re harder, not impossible.
- Install iOS updates promptly, and turn on automatic updates.
- Restarting your phone now and then clears some kinds of malware.
- Company phones need a policy on minimum OS versions.