There is a serious vulnerability in iOS that has not yet been patched

A Russian security expert dubbed illusionofchaos has released four serious iOS vulnerabilities, three of which have yet to be fixed, after Apple ignored his messages for half a year.

Like all major tech companies, Apple has a scope Rewards Program which pays up to $1 million to participants who report security flaws in their systems. But it doesn’t always work as it should.

The hacker illusion reported four vulnerabilities to Apple – particularly serious security flaws that must be mitigated in some way – between March 10 and May 4. as your own story In fact, Apple fixed one of these vulnerabilities with iOS 14.7, but did not mention it on its security updates page. The other three are still in iOS 15, as confirmed on Twitter Costa Eleftherio.

These vulnerabilities allow iOS Game Center to be exploited to extract important personal data from the user. An app downloaded from the App Store and attacking these flaws can access:

• Apple ID email and full name of the user.
• An Apple ID authentication code that allows requests to be made to at least one Apple service on the user’s behalf (gc.apple.com).
• Core Duet database with read permissions (contains the contact list from Mail, SMS, iMessage, and third-party messaging apps, and metadata for all user interactions with those contacts, including time and statistics, as well as some attachments, such as links and text).
• Contact application database and contact database with read permissionsra (contains contact photos and other metadata such as creation and modification dates). Although this is no longer available from iOS 15.

Illusionofchaos provided a proof of concept that allowed other experts such as Eleftheriou to confirm these failures. Since they are not patched, you can only be careful what you install on iOS until Apple decides to release a security patch.

Just a week ago, Apple Issue a security update To fix other exploitable zero-day vulnerabilities from iMessage.