Wired
Despite reporting to Apple that a zero-day vulnerability exists in iOS, Apple ignored it, and security researchers have complained on their blog that the vulnerability remains unfixed in iOS 15.
4 reports, 3 remain uncorrected
According to security researcher illusion of chaos, he participated in Apple’s Security Bounty Program, discovering four zero-day vulnerabilities between March 10 and May 4, 2021 and reporting them to Apple.
One of them was fixed in iOS 14.7, but the other three remain unfixed in the latest iOS 15, illusion of chaos said.
What’s more, the fact that he discovered and fixed it wasn’t posted on Apple’s iOS 14.7 security content page, so illusion of chaos complained about it. Apple apologized and promised to post it in the next update, but it hasn’t been posted at this time.
No response from Apple, open to the public
Illusionofchaos contacted Apple again about one unlisted case and three zero-day vulnerabilities left unattended. However, in the end, there was no response from Apple, and he judged that “sufficient days (about half a year) have passed since the vulnerability was reported” (Google Project Zero released it 90 days after receiving the vulnerability report). On September 23, local time, he published a series of vulnerabilities and interactions with Apple on his blog.
“I’m not the only one disappointed with Apple’s security bounty program,” said illusionofchaos. I am explaining.
Since it is a specialized content, I will not go into the details of the vulnerability here, but only give an overview.
- Gamed 0-day: A vulnerability that allows apps installed from the App Store to access information such as Apple ID emails without the user’s permission.
- Nehelper Enumerate Installed Apps 0-day: A vulnerability that allows an installed app to determine if another app associated with an arbitrary ID is installed on the device.
- Nehelper Wifi Info 0-day: A vulnerability that allows apps that meet the conditions to access Wi-Fi information without permission.
Source: illusion of chaos / Habr via 9to5Mac, About the security content of iOS 14.7 and iPadOS 14.7
(lunatic)
Source: iPhone Mania