Google Project Zero researchers Natalie Silvanovich and Samuel Groß describe the vulnerabilities as “interactionless.” In other words, no action on the user’s part is needed to exploit the device. For at least four of them, however, the user must open a malicious message.
The majority of the vulnerabilities discovered by google were so-called “interactionless” bugs, meaning they can be executed on a remote iOS device without requiring any sort of direct interaction with the phone. An attacker simply has to send malicious code via iMessage and wait for the victim to open it. Because these “interactionless” bugs are in high demand for hackers, the security flaws discovered would have sold on the black market or other seedy parts of the internet for as much as $5 million apiece, according to ZDNet.
While Apple largely addressed these significant security flaws with the release of iOS 12.4 on July 22nd, the researchers are holding back on revealing the details of one vulnerability that has not yet been fully patched. Users are advised to keep their phones up to date and download updates as soon as they become available in order to avoid any significant security risks.
