After analyzing the problematic devices with mvt-ios (iOS Mobile Verification Toolkit), Kaspersky discovered that attackers can send messages via iMessage, and after receiving the message, the victim can trigger an in-system vulnerability without any user interaction to execute arbitrary malicious code.

The vulnerability downloads other malicious scripts from command and control (C&C) servers that can be used to elevate their privileges, clean up intrusion traces, steal user data, and more.

Kaspersky says the malicious scripting is not persistent and resets after users reboot their devices, and Kaspersky as reported that as of June 2023, the vulnerability is only valid for iOS 15.7 and prior versions.

The post Apple iMessage was used to spread malware in iOS 15.7 and previous versions appeared first on TechGoing.

After Apple unsigned iOS 16.0.3 earlier this week, about a week after releasing iOS and iPadOS 16.1 to the public, Apple also unsigned iOS and iPadOS 15.7.7 on Friday after launching iOS and iPadOS 15.7.1. This also means users can no longer downgrade or upgrade to that version using Finder or iTunes.

Apple typically turns off verification for older versions of iOS after a new version is released to encourage users to keep the operating system up to date.

Apple iOS 15.7.1 / iPadOS 15.7.1 was released at the end of October. iOS 15.7.1 is a smaller update, which Apple only says includes important security fixes.

Version 15.7, on the other hand, was released in mid-September, and in addition to fixing security issues in Contacts, Maps, Safari, Safari Extensions, Shortcuts, and WebKit, the iOS 15.7 and iPadOS 15.7 updates also address multiple kernel vulnerabilities.

The post Apple closes iOS 15.7 (19H12) verification channel, users can no longer downgrade to this version appeared first on TechGoing.