Bill Marczak

A physical attack may disable USB Restricted Mode on a locked device. This issue is related to an authorization problem that has been addressed with improved state management. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals. The vulnerability allows attackers to bypass USB Restricted Mode, which is a security feature designed to prevent data extraction from locked devices.

A certificate validation issue exists in Apple’s CoreTrust security component, potentially allowing malicious applications to bypass signature validation. Reports indicate that this issue may have been actively exploited against versions of iOS prior to version 16.7. The CoreTrust vulnerability, identified as CVE-2023-41991, was reportedly exploited by commercial surveillance vendors, including Intellexa and NSO Group, to install malicious software on iPhones. The issue involves incorrect validation of apps with multiple signers, allowing attackers to circumvent normal signature checks. This flaw was used in conjunction with other vulnerabilities, such as local privilege escalation and remote code execution. The exploit was significant enough that Apple released patches in iOS versions 16.7 and 17.0.1, as well as macOS Ventura 13.6, watchOS 9.6.3, and watchOS 10.0.1 to address the vulnerability.

The issue involves insufficient checks when processing web content within the kernel of iOS, watchOS, iPadOS, and macOS, potentially allowing an attacker to elevate their privileges. Reports indicate that this issue may have been actively exploited in versions of iOS prior to iOS 16.7. The vulnerability allows malicious applications to bypass signature validation and gain elevated privileges. The issue was addressed by implementing improved checks. The vulnerability affects multiple Apple platforms. Technical details reveal the exploitation involves triggering a bug on an old thread, invoking `ipc entry grow table()` through `mach port allocate name()`, and subsequently calling `mach thread self()` to obtain a new mach name.

A vulnerability exists in the WebKit engine, potentially allowing attackers to execute arbitrary code by processing malicious web content. This issue has been actively exploited in some instances, with reports indicating exploitation against iOS versions prior to 16.7. The vulnerability was addressed through improved checks in updated versions of the software. A threat actor, linked to Russia’s Foreign Intelligence Service (SVR), leveraged this vulnerability (CVE-2023-41993) in a watering hole campaign, compromising legitimate websites and redirecting visitors to malicious login pages to harvest Microsoft 365 credentials. Intellexa, a spyware vendor, also utilized this vulnerability as part of a zero-day exploit chain to deploy the Predator spyware on targets in Egypt. The exploit chain involved multiple zero-day vulnerabilities, including CVE-2023-41993, to gain deep access to devices.

The issue concerns the use of the ECB mode of AES for encryption, which can reveal structural information about encrypted messages. In the case of Zoom Client for Meetings, all participants in a meeting use a single 128-bit key for video and audio encryption. Similarly, Microsoft Office 365's message encryption uses the ECB mode, allowing attackers to potentially determine the content of encrypted messages by analyzing patterns. This problem was previously identified in 2013 and again in 2020. It is reported that Microsoft has been aware of the issue since January 2022 but has not yet released a fix, although they are working on adding an alternative encryption protocol to future product versions.