Two members of Project Zero, Google’s elite bug-hunting team, have published details and demo proof-of-concept code for five of six “interactionless” security bugs that impact the iOS operating system and can be exploited via the iMessage client.
All six security flaws were patched last week, on July 22, with Apple’s iOS 12.4 release.
Details about one of the “interactionless” vulnerabilities have been kept private because Apple’s iOS 12.4 patch did not completely resolve the bug, according to Natalie Silvanovich, one of the two Google Project Zero researchers who found and reported the bugs.
The bugs were discovered by Silvanovich and fellow Google Project Zero security researcher Samuel Groß… When sold on the black market, vulnerabilities like these can bring a bug hunter well over $1 million, according to a price chart published by Zerodium. It wouldn’t be an exaggeration to say that Silvanovich just published details about exploits worth well over $5 million, and most likely valued at around $10 million.
MacDailyNews Take: Like it or not, Project Zero helps make all operating systems they investigate safer, including the world’s most advanced mobile operating systems, iOS and iPadOS.
If you haven’t updated your iOS devices to iOS 12.4, do so as soon as possible.