Hackers Trigger Fake iOS Updates on Hijacked Devices

August 7, 2024

Researchers investigate the use of fraudulent iOS updates by malicious actors to establish persistent access to compromised devices by comprehensively analyzing the attack lifecycle, examining initial device compromise, in-device operations, data exfiltration, and the overall threat landscape.

The study emphasizes the unique challenges of securing mobile devices compared to traditional network perimeters, highlighting the need for multi-layered defense strategies to mitigate the risks posed by evolving mobile threats.

An intricate mechanism of a simulated iOS update is designed to deceive users of compromised devices into believing they are installing iOS 18, the latest and most secure operating system.

While researchers often utilize frameworks like MITRE ATT&CK to examine the complete attack lifecycle, the analysis focuses specifically on the persistence phase of a mobile attack, exploring the deceptive tactics employed to maintain unauthorized access to the target device.

Specifically, they examine techniques to modify system update settings, generating fraudulent prompts and notifications suggesting an available iOS 18 update, aiming to mislead users into granting unnecessary permissions or executing malicious code under the guise of a legitimate system update.

Attackers prioritize persistence after gaining initial access, as their objective is to remain undetected for extended periods (an average of 277 days) to maximize data collection, which necessitates employing stealthy tactics.

In the iOS update scenario, the attacker employs a meticulously crafted, seemingly legitimate update to maintain persistence and further compromise the device’s integrity, which masks malicious activity and allows the attacker to operate undetected for a significant timeframe.

The system exploits user trust by mimicking legitimate iOS update visuals and language, creating a deceptive sense of authenticity.

Underneath, it employs advanced techniques to intercept device-server communications, redirecting updates to a controlled fake environment, which bypasses Apple’s official channels, assuming the device has already been compromised.

Compromised devices cannot be updated to the latest iOS version, specifically iOS 18, rendering them vulnerable to exploitation. This inability to patch critical security vulnerabilities exposes devices to a heightened risk of malicious attacks.

To mitigate this threat, users must verify the authenticity of update prompts, relying solely on trusted sources like Apple’s official channels to protect their devices from compromise.

Jamf provides a layered mobile security framework encompassing device enrollment, configuration management, endpoint protection, threat detection, and zero-trust access.

By enforcing compliance standards, detecting advanced threats, and implementing robust access controls, it empowers organizations to safeguard their iOS devices and sensitive data against sophisticated cyberattacks, as exemplified by the recent iOS vulnerabilities.