Apple releases security updates, adds new privacy protection for iOS users
Apple has released new versions of its many operating systems and software products, with fixes for a wide variety of vulnerabilities.
The iOS update also comes with USB Restricted Mode, a new security feature that will protect users’ iPhones and iPads from being accessed by law enforcement with software cracking tools like GrayKey.
iOS USB Restricted Mode
USB Restricted Mode was first introduced in iOS 12 beta, but apparently Apple has decided that the feature should be provided to users as soon as possible.
Once users update to the newest version of the mobile OS, the mode will be turned on by default and should thwart currently available third-party solutions used by law enforcement agencies to access data from suspects’ locked iPhones, as access via the devices’ Lightning port will be disabled if they haven’t been unlocked for over an hour.
The mode can be turned off by users in the device Settings (Settings > Face ID & Passcode > USB Accessories). If you want the protection the mode offers, keep the toggle disabled (as seen below).
Security updates
The security updates for iTunes for Windows and iCloud for Windows fix the same issues: a bucketload of WebKit vulnerabilities (mostly memory corruption issues, some of which could lead to arbitrary code execution) and a cookie management issue that could allow cookies to unexpectedly persist in Safari.
The Safari update (11.1.2) fixes all of those issues plus three other vulnerabilities that could be exploited by malicious websites to spoof the address bar.
The iOS security update fixes many of the same problems and some additional ones, including a bug that could lead to a denial of service if an emoji is processed under certain configuration, and a Wi-Fi bug that could allow a malicious app to break out of its sandbox.
The emoji flaw (discovered by Patrick Wardle of Digita Security) has also been fixed in watchOS. Aside from that, the tvOS and watchOS security updates are almost identical and contain fixes for kernel and the WebKit issues mentioned earlier, as well as two libxpc flaws that can be exploited by malicious applications to gain elevated privileges and read restricted memory.
In the macOS security update Apple has fixed the information disclosure issue that could be exploited via Lazy FP state restore on systems using Intel Core-based microprocessors, as well as vulnerabilities in AMD, APFS and ATS (the latter can be exploited by a malicious application to gain root privileges).