Apple’s upcoming iOS 14.5 and iPadOS 14.5 updates will make it considerably tougher for the bad actors of the world to pull off zero-click attacks. The updates will do so by extending PAC security provisions, says a report by Motherboard.
Apple has made a change in the way that it secures its code in the latest betas, making zero-clicks much more difficult. The new code, spotted by security researchers and confirmed by Apple, will be included in the final update.
Zero-click (or 0-click) exploits, allow a hacker to take over an iPhone with no interaction from the target, such as clicking a malicious link. This makes zero-click attacks considerably tougher for users to detect.
From Motherboard:
The change centers around something called ISA pointers. Since 2018, Apple has implemented a technology called Pointer Authentication Codes (or PAC) to protect iPhone users from exploits which inject malicious code by preventing attackers from leveraging corrupted memory, according to Apple’s Platform Security Guide. This is done by using cryptography to authenticate these pointers and validate them before they’re used. ISA pointers are a related feature of iOS’s code that tells a program what code to use when it runs. Until now, they were not protected with PAC, as Samuel Groß from Google Project Zero explained last year. By using cryptography to sign these pointers, Apple extended PAC protections to ISA pointers.
“Nowadays, since the pointer is signed, it is harder to corrupt these pointers to manipulate objects in the system. These objects were used mostly in sandbox escapes and zero-clicks,” security firm Zimperium’s Adam Donenfeld told Motherboard.
While not all zero-click attacks will be prevented through the change, it will prevent hackers and government organizations from using many of the exploitations they have in the past.