Apple on Wednesday ceased code signing of iOS 12.4, which was an incremental update that included a security flaw that hackers quickly leveraged to create a jailbreak for iOS devices.
By ending code signing for the older version of iOS, Apple closes the security hole used by jailbreakers and hackers. The move also prevents users from downloading older code. allowing Apple to keep more iOS devices on the latest version of their software.
The code signing halt for iOS 12.4 comes two weeks after the release of iOS 12.4.1 in late August. iOS 12.4.1 patched the security hole, shutting down the jailbreak.
iOS 12.4, released back in June, had reopened a once-closed security flaw. Google security researchers discovered the vulnerability earlier this year and Apple had closed it in iOS 12.3.
Shortly following the public release of iOS 12.4, researcher “pwn2ownd” used the reintroduced security flaw to jailbreak iOS devices. It was one of the first jailbreaks to target a then-current version if iOS in years.
The bug could also apparently be used to install spyware on a target iPhone, as pointed out by Ned Williamson from Google Project Zero.
The researcher told Motherboard that “somebody could make a perfect spyware” taking advantage of the reopened security hole. He said, a malicious app could include an exploit for this bug that allows it to escape the usual iOS sandbox – a mechanism that prevents apps from reaching data of other apps or the system – and steal user data.
(Via AppleInsider)
