News

Apple has addressed a long-standing vulnerability in its iPhone and iPad software that had undermined a privacy feature introduced in iOS 14. The feature was designed to prevent wireless routers and access points from collecting an Apple device’s unique MAC address. However, security researchers Tommy Mysk and Talal Haj Bakry discovered a flaw that rendered the privacy feature ineffective since its inception.

The iOS feature aimed to replace the device’s real MAC address with a randomized “private address” for each network. However, Mysk found that the real MAC address was still included in the AirPlay discovery requests sent by iPhones when connecting to a network. This revelation meant that these real MAC addresses were broadcasted to all connected devices on the network, potentially enabling device tracking across different networks.

Even when users enabled Lockdown Mode, designed to protect against targeted cyberattacks, iPhones and iPads continued to send these requests. Mysk reported the issue to Apple in July, but it took time for Apple to replicate and fix the problem. The vulnerability, identified as CVE-2023-42846, has been resolved with the release of iOS 17.1 and iOS 16.7.2 for older devices running iOS 16.

While Apple has not disclosed the severity of the bug, the vulnerability rating score system categorizes it as “high.” The recent iOS 17.1 update also addressed other vulnerabilities, including a flaw that could have granted unauthorized access to passkeys and a Siri bug that exposed sensitive data to hackers with physical device access.

This fix demonstrates Apple’s commitment to addressing security concerns and enhancing privacy features for its users. By promptly resolving this vulnerability, Apple has taken a significant step towards ensuring the privacy and security of its devices.

The post Apple Fixes Vulnerability in iOS Software to Enhance Privacy Feature appeared first on Fagen Wasanni Technologies.