Скачать или смотреть #Security

The Passwords app released in iOS 18 does not use the secure HTTPS protocol by default. Instead, it opens links and downloads account icons over HTTP, making it vulnerable to phishing attacks. In this video, we demonstrate how the Passwords app opens links to change a password using HTTP by default. An attacker with privileged network access can easily intercept the HTTP request and redirect the victim to a malicious website controlled by the attacker.

We reported this bug in September 2024. Although Apple addressed it in iOS 18.2, the report remained open, and Apple only recently acknowledged fixing the bug. This is why we couldn't disclose the issue earlier. Apple updated the security release notes on March 25, 2025 to include this bug:


https://support.apple.com/en-us/121837

The CVE ID of the bug is CVE-2024-44276.

The Passwords app also used to download website icons over HTTP (CVE-2024-54492). We demonstrated that here:
   • iOS #Security: The Passwords app has a ser...  

For more content like this, you can find us here:

Twitter/X: https://x.com/@mysk_co
Mastodon: https://mastodon.social/@mysk
Bluesky: https://bsky.app/profile/mysk.bsky.so...


#iOS #privacy #iPhone #Apple #Cybersecurity