Mai exact, iOS-ul avea o vulnerabilitate care le permitea unor hackeri sa fure cookie-uri folosite de catre Safari pentru navigare pe internet si sa pacaleasca utilizatorii de iDevice-uri sa se logheze in website-uri menite sa le fure parolele, sau sa le fure identitatea online.
Desi problema a fost raportata acum 2 ani catre compania Apple, iata ca nimeni din Cupertino nu s-a grabit sa o rezolve, desi ea punea in pericol utilizatorii care navigheaza pe internet folosind Wi-Fi-urile publice, deci practic oricine era o posibila victima a hackerilor.
De ce a ales Apple sa astepte 2 ani sa rezolve o problema de securitate atat de importanta nu stie nimeni, insa puteti sta linistiti deoarece incepand cu iOS 9.2.1 veti fi protejati impotriva hackerilor care incearca sa va fure identitatea online si nu doar atat.
This issue allows an attacker to:
- Steal users’ (HTTP) cookies associated with a site of the attacker’s choice. By doing so, the attacker can then impersonate the victim’s identity on the chosen site.
- Perform a session fixation attack, logging the user into an account controlled by the attacker-because of the shared Cookie Store, when the victims browse to the affected website via Mobile Safari, they will be logged into the attacker’s account instead of their own.
- Perform a cache-poisoning attack on a website of the attacker’s choice (by returning an HTTP response with caching headers). This way, the attacker’s malicious JavaScript would be executed every time the victim connects to that website in the future via Mobile Safari.