-
Researchers at Google’s cybersecurity division Project Zero discovered a handful of websites that were being used to hack iPhones.
-
Once visited, the websites would plant a “monitoring implant” on the device, which could then steal messages, photos, and real-time GPS location data.
-
The hacks spanned iOS 10 through 12, which Project Zero said indicated they took place over the course of two years.
Google researchers have found a handful of hacked websites that were being quietly used to infiltrate iPhones for at least the past two years. Business Insider reports.
Analysts at Google’s cybersecurity division Project Zero published a deep-dive technical blog post Thursday night detailing their findings.
“There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant,” the security researcher Ian Beer wrote in the blog. Once inside the iPhone, this implant was able to steal messages, photos, and GPS location data in real time.
Though the blog post didn’t say exactly how many of these websites they were, the researchers estimated each one received thousands of visitors a week. The hacks spanned iOS 10 through 12, which Beer said indicated a “sustained effort” to hack iPhones over a period of two years.
The websites gained access to the iPhones through five methods, or “exploit chains.” The researchers found 14 separate vulnerabilities that made these exploit chains possible. Seven of these vulnerabilities were found in Safari, the iPhone’s default web browser.
The researchers told Apple about their findings in February and gave the company a seven-day deadline to fix the vulnerabilities. Six days later, Apple updated the security on iOS 12. Google gave Apple a much tighter deadline than is usual in security disclosure, the norm being 90 days to patch issues.
Apple generally has a strong reputation when it comes to security, and earlier this month the company upped the amount of money it’s willing to shell out for bug bounties — vulnerabilities found by security researchers — to $1 million.
Apple declined to comment when contacted by Business Insider.