Using iPhone or MacBook? Govt says update your Apple devices now to protect them from hacking

In a recent advisory, CERT-In has alerted Apple users to critical security vulnerabilities in iPhones, MacBooks, and other devices. It has urged users to immediately run software updates to prevent potential hacking risks.

In Short

• CERT-In says many Apple devices are affected by serious vulnerabilities
• It has issued high risk warning for iPhone, iPad, and MacBook users
• Users are urged to update their devices to the latest software versions immediately

In yet another cybersecurity advisory, the Indian Computer Emergency Response Team (CERT-In) has alerted Apple product users, including those using iPhones and MacBooks, about multiple vulnerabilities. These critical flaws have been explained in advisory CIAD-2024-0058, highlighting issues that, if not addressed by users, could lead to unauthorised access, data theft, or system control by hackers.

In its advisory note, CERT-In has outlined two significant vulnerabilities affecting a range of Apple products, including:

iPhones and iPads: Running iOS and iPadOS versions prior to 18.1.1 and 17.7.2.
MacBooks and Desktops: Using macOS Sequoia versions prior to 15.1.1.
Vision Pro: Running visionOS versions prior to 2.1.1.
Safari Browser: Versions earlier than 18.1.1.

Describing more on the vulnerabilities CERT-In that they have discovered two flaws:

1. Arbitrary Code Execution (CVE-2024-44308)

This vulnerability resides in JavaScriptCore, the engine used by Apple's Safari browser and other applications to process JavaScript. Malicious actors can exploit this vulnerability by sending specially crafted web content to execute arbitrary code on the target device. This could allow hackers to take control of systems and run unauthorized applications.

2. Cross-Site Scripting (XSS) (CVE-2024-44309)

This vulnerability exists in WebKit, the browser engine behind Safari and other web content on Apple devices. Exploiting this issue involves sending maliciously crafted web content that triggers XSS attacks, potentially allowing attackers to manipulate web pages, steal sensitive data, or impersonate users online.

CERT-In notes that both vulnerabilities pose a serious threat to individual and organisational users.

– Hackers could gain access to sensitive personal or organisational data, such as passwords, financial information, or confidential business files.

– Attackers could steal or alter stored data, potentially leading to identity theft or compromised records.

– Cyberattackers could exploit these vulnerabilities to crash systems or disrupt normal operations, causing significant downtime.

– Hackers could also gain full control of affected devices, allowing them to install malware, spy on user activity, or use the system for malicious purposes.

Highlighting the severity of these flaws, CERT-In notes that these vulnerabilities might have already been actively exploited on Intel-based Mac systems. Hence, it advises users to take immediate action.

How to stay safe

To help users protect their Apple devices, CERT-In strongly advises users to update their devices to the latest software versions. To update:

For iPhones and iPads: Go to Settings > General > Software Update and install the latest iOS or iPadOS version.

For MacBooks: Open System Preferences > Software Update and upgrade to macOS Sequoia 15.1.1 or later.

For Vision Pro: Navigate to Settings > Software Update to ensure you’re on visionOS 2.1.1 or above.

For Safari browser: Update to version 18.1.1 via the App Store or through system updates.