Google researcher details sustained, indiscriminate iPhone malware attack spread via hacked websites

For at least two years, hackers used compromised websites to install malware on iPhones that could gather and upload a user's photos, contacts, and other data, Google cybersecurity researcher Ian Beer explained in a blog post Thursday evening. "There was no target discrimination: Simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, to install a monitoring implant." The exploits were discovered "in the wild," Beer said, meaning they were being used by real cybercriminals in the real world.

The hackers were able to attack "almost every version from iOS 10 through to the latest version of iOS 12," Beer said, though Apple patched the vulnerability in February after Beer and his associates at Google's Project Zero alerted the company to it. "This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years." He did not speculate as to who was behind the attack or which groups it targeted, and he didn't name the hacked websites, saying only they were visited thousands of times a week. Apple told BBC News it did not wish to comment on Beer's post.

iPhone users should download the latest updates for their devices, but "the reality remains that security protections will never eliminate the risk of attack if you're being targeted," Beer writes. "All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them."

Subscribe to The Week

Escape your echo chamber. Get the facts behind the news, plus analysis from multiple perspectives.

SUBSCRIBE & SAVE

Sign up for The Week's Free Newsletters

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

From our morning news briefing to a weekly Good News Newsletter, get the best of The Week delivered directly to your inbox.

Sign up