Apple Acknowledges Security Flaw in iPhone, iPads That Hackers May Have Used To Steal Data For Years

Apple Inc. AAPL on Wednesday acknowledged that its email app for iPhones and iPads had a security flaw, Reuters reported.

What Happened

Researchers at cybersecurity startup ZecOps published a report earlier in the day that said vulnerability in the Mail app could have exposed half a billion Apple device users to data theft.

According to ZecOps, hackers could send a blank email to the users as part of the hack. If the user attempted to open the email, it would crash the Mail app and provide a getaway for the hackers to steal data that the app had access to, including other emails or photos and files stored on the device.

An Apple spokesperson told Reuters that the company had developed a fix and it would be deployed with the next update, but it didn't comment on the ZecOps report, or say how many users could have been affected.

Millions Of Users Could Have Been Hit

ZecOps said it suspects hackers used the vulnerability to target high profile users including individuals at Fortune 500 companies, a "very important person" from Germany, an executive from a Japanese carrier, managed security service providers from Saudi Arabia and Israel, a Journalist in Europe.
According to the researchers, millions of Apple users could have been affected by this vulnerability, and they could trace abuse going as far back as 2018. Even the latest versions of the Apple iOS operating system are vulnerable to the hacks, they said.

A former researcher at the United States National Security Agency and an Apple security expert, Patrick Wardle, told Reuters that the discovery "confirms what has always been somewhat of a rather badly kept secret: that well-resourced adversaries can remotely and silently infect fully patched iOS devices."

This is one of the rare instances of "zero-day" vulnerabilities being discovered with Apple devices, that is, one where the company wasn't aware of the glitch.