These legit looking iPhone cables allow hackers to take charge of your computer

When they said you should be wary of third-party accessories and unbranded cables for charging your smartphone, they were serious. And the latest example of what a cable that isn’t original can do, should be enough to scare you. There is apparently a Lightning Cable that looks just as harmless as an iPhone cable should. But it has a nasty trick up its sleeve, which allows a hacker to take control of your computer, the moment you plug this in to the USB port. This cable has been dubbed the OMGCable.

A security researcher with the Twitter handle @_MG_ took a typical USB to Lightning cable and added a Wi-Fi implant to it. The moment this gets plugged into the USB port on a PC, a hacker sitting nearby with access to the Wi-Fi module hidden inside the cable can run a malicious code and take charge of a PC or remotely access data without the user even noticing.

“This specific Lightning cable allows for cross-platform attack payloads, and the implant I have created is easily adapted to other USB cable types. Apple just happens to be the most difficult to implant, so it was a good proof of capabilities,” said MG, as reported by the TechCrunch website.

The thing with phone charging cables is that no one really gives them a second look. You see one, you plug it in and you let it be. At the same time, a lot of users are wary about using USB drives, also known as pen drives or thumb drives, because they are popular as carriers of malware and viruses that can pretty much ruin your PC.

Hack an iPhone, win $ 1 million


Apple has massively increased the amount it’s offering hackers for finding vulnerabilities in iPhones and Macs, up to $1 million. It’s by far the highest bug bounty on offer from any major tech company.

That’s up from $200,000, and in the fall the program will be open to all researchers. Previously only those on the company’s invite-only bug bounty program were eligible to receive rewards.

As Forbes reported on Monday, Apple is also launching a Mac bug bounty, which was confirmed Thursday, but it's also extending it to watchOS and its Apple TV operating system. The announcements came in Las Vegas at the Black Hat conference, where Apple’s head of security engineering Ivan Krstić gave a talk on iOS and macOS security.

Forbes also revealed on Monday that Apple was to give bug bounty participants “developer devices”—iPhones that let hackers dive further into iOS. They can, for instance, pause the processor to look at what’s happening with data in memory. Krstić confirmed the iOS Security Research Device program would be by application only. It will arrive next year.

$1 million for an iPhone hack

The full $1 million will go to researchers who can find a hack of the kernel—the core of iOS—with zero clicks required by the iPhone owner. Another $500,000 will be given to those who can find a “network attack requiring no user interaction.” There’s also a 50% bonus for hackers who can find weaknesses in software before it's released.

Apple is increasing those rewards in the face of an increasingly profitable private market where hackers sell the same information to governments for vast sums.

As Maor Shwartz told Forbes, the cost of a single exploit (a program that uses vulnerabilities typically to take control of a computer or phone) can fetch as much as $1.5 millon. An exploit targeting WhatsApp where no clicks are required from the user, for instance, can be sold to a government agency for that much, though such tools are rare. Only one or two a year will be sold, from a pool of around 400 researchers who focus on such high-end hacking. “It’s really hard to research them and produce a working exploit,” he said.

An iMessage Vulnerability Patched by Apple Allowed Potential Attackers to Read Contents of Files





An iMessage vulnerability was discovered by Google Project Zero security researcher was as of late fixed by Apple as a component of the 12.4 iOS update which enabled potential attackers to peruse contents of many files put away on iOS devices remotely with no user interaction.

The security flaw tracked as CVE-2019-8646 was reported in Apple during May. Natalie Silvanovich, the researcher who found the vulnerability created the proof of concept works just on devices running iOS 12 or later and said that it is structured as "a simple example to demonstrate the reach-ability of the class in Springboard. The actual consequences of the bug are likely more serious."
Describing the issue in detail on Project Zero's bug tracker she says:

 “First, it could potentially allow undesired access to local files if the code deserializing the buffer ever shares it (this is more likely to cause problems in components that use serialized objects to communicate locally than in iMessage). Second, it allows an NSData object to be created with a length that is different than the length of its byte array. This violates a very basic property that should always be true of NSData objects. This can allow out of bounds reads, and could also potentially lead to out-of-bounds writes, as it is now possible to create NSData objects with very large sizes that would not be possible if the buffer was backed.”

Later adding the Google security researcher says that ‘the iMessage issue is caused by the _NSDataFileBackedFuture class which can be deserialized even if secure encoding is enabled. This class is a file-backed NSData object that loads a local file into memory when the [NSData bytes] selector is called.’

Apart from this Silvanovich discovered two other iMessage vulnerabilities in collaboration with Google Project Zero's Samuel Groß, flaws that additionally got fixed in the iOS 12.4 update.
The first is memory vulnerability in Core Data tracked as CVE-2019-8660 fixed with improved length checking and the second, a Core Data use after free issue tracked as CVE-2019-8647 that may enable a remote attacker to cause arbitrary code execution on iPhone 5s or iPad's.

In general, five iMessage bugs were found by Silvanovich, with the last two being an input validation issue which could block devices with a contorted message, that was fixed in iOS 12.3 and released on May 13 and an 'out-of-bounds read' read prompting a memory leak which was fixed in watch iOS 5.3 issued on July 22.


iPhone hacking tool for sale on eBay

iPhones are renown for their security -- to the point that even law enforcement agencies have trouble accessing their contents. An Israeli firm, Cellebrite, became well-known when it transpired that hacking tools it made were used by the US government to crack locked iPhones and now its hacking tools are available to buy on eBay.

Cellebrite phone-cracking devices, beloved by law enforcement, are available at bargain-basement prices so you can get a gander at all the devices that the police have presumably been able to squeeze for data.

The Cellebrite Universal Forensic Extraction Device (UFED) is a smartphone hacking tool commonly used by the FBI, Department of Homeland Security and other law enforcement agencies in the US and elsewhere. It’s the most powerful tool yet created by the Israeli company, able to extract a huge amount of data – even data which has been deleted from phones.

Security researcher Matthew Hickey who is the co-founder of the training academy, Hacker House recently told Forbes that he’d picked up a dozen Cellebrite UFED devices for dirt cheap and probed them for data, which he found in spades.

For as little as $100-$1000, you can get your hands on a second-hand piece of Cellebrite equipment (a fraction of its usual selling price). For just a few Benjamins, you could get a Cellebrite UFED (Universal Forensic Extraction Device) and use it for whatever you might fancy.

A brand new one normally costs $5,000 to $15,000 depending on the model.

What surprised Hickey was that nobody bothered to wipe these things before dumping them onto eBay, he told Forbes:

“You’d think a forensics device used by law enforcement would be wiped before resale. The sheer volume of these units appearing online is indicative that some may not be renewing Cellebrite and disposing of the units elsewhere.”

Apple Inc. Announces Free Screen Replacement For Affected iPhone X Units



Apple Inc. at last, affirms display issues with iPhone X units. The declaration went ahead on Friday after the iPhone X was discontinued in September following the dispatch of the iPhone XS and XR. The iPhone X was launched a year ago and reports of display issues sprung up a couple of months back, yet Apple did not react at the time. Furthermore, Apple has likewise conceded that some 13-inch MacBook Pro models have "an issue that may result in data loss and failure of the drive."

The California based giant affirms that the screen on some iPhone X units does not react to touch or reacts irregularly when contacted additionally, further adding that iPhone X users who have been confronting this issue will be helped to at whatever point they will visit an Apple Store or Apple Authorised Service Providers to get a screen substitution free of expense.

Apple confirmed that a set number of 13-inch non TouchBar MacBook Pros that were sold between June 2017 and June 2018 may experience the ill effects of data loss or failure and has reported a repair program for the influenced gadgets with 128GB and 256GB of solid-state drives. The company will likewise email users who have enrolled their devices with Apple to educate them more about the program.

Apple has set aside its opportunity to respond towards the touchscreen issue on the iPhone X. Starting now, it appears as if the issue is constrained to last year's model and not the new iPhone XS and XR. That being stated, the most recent iPhones have likewise observed a couple of issues since dispatch, such as not charging when the Lightning cable is connected and the selfie camera "Beautygate" issue, the two of which have been discreetly settled by Apple through the software update.