Centre issues 'severe' warning for Apple users over multiple vulnerabilities

Apple's threat notification highlights that these mercenary spyware attacks are exceptionally rare and more sophisticated than typical cybercriminal activities or consumer malware.

The Indian Computer Emergency Response Team (CERT-In) has issued a "severe" warning to all Apple users, flagging multiple vulnerabilities in Apple products such as iPhones, iPads, Macs, and more. The vulnerabilities could lead to sensitive information leaks, arbitrary code execution, security bypasses, denial of service (DoS) attacks, and spoofing attacks.

According to the CERT-In advisory dated August 2, the affected Apple software includes iOS and iPadOS versions prior to 17.6 and 16.7.9, macOS Sonoma versions prior to 14.6, macOS Ventura versions prior to 13.6.8, macOS Monterey versions prior to 12.7.6, watchOS versions prior to 10.6, tvOS versions prior to 17.6, visionOS versions prior to 1.3, and Safari versions prior to 17.6.

The central agency has urged Apple users to apply the necessary software updates as listed by the company to mitigate any high-level risks. Apple has not yet confirmed any security risk from their side.

In a related issue, Apple has been sending alerts about potential "mercenary spyware attacks," similar to Pegasus from the NSO Group to users in over 150 countries, including India. These alerts were issued to warn users about sophisticated spyware aimed at remotely compromising iPhones.

Notable individuals such as Iltija Mufti, media adviser and daughter of former Jammu and Kashmir chief minister Mehbooba Mufti, and Pushparaj Deshpande, founder of Samruddha Bharat Foundation, have publicly stated they received notifications from Apple about potential hacks on their phones.

Apple's threat notification highlights that these mercenary spyware attacks are exceptionally rare and more sophisticated than typical cybercriminal activities or consumer malware.

The Ministry of Electronics and Information Technology (MeitY) and Apple have not responded to queries regarding these issues. CERT-In continues to monitor the situation and advises users to stay updated with the latest security patches.