Apple iPhone, iPad bug may have allowed hackers to steal your data

According to its findings, all Apple iPhones and iPads running on iOS 6 and above are vulnerable to this hack and it is possible that older iOS versions too may have been affected by this bug.

Apple is working to release an update to fix this bug. (REUTERS)

Apple is planning to fix a flaw in its iPhones and iPads that may have allowed malicious hackers to deal users' data via the company's mailing service, Apple Mail.

US-based cyber security firm, ZecOps, has found a flaw in iOS and iPadOS that allows hackers to use infected emails to trigger a vulnerability in the company's software, which in turn would let them steal data from users' Apple devices.

"The attack's scope consists of sending a specially crafted email to a victim's mailbox enabling it to trigger the vulnerability in the context of iOS MobileMail application on iOS 12 or maild on iOS 13. Based on ZecOps Research and Threat Intelligence, we surmise with high confidence that these vulnerabilities - in particular, the remote heap overflow - are widely exploited in the wild in targeted attacks by an advanced threat operator(s)," ZecOps wrote in a blog post.

The cyber security found a number of suspicious events that had exploited this bug in iOS dating as far back as Jan 2018, which is when the company started investigating the matter.

According to its findings, all Apple iPhones and iPads running on iOS 6 and above are vulnerable to this hack and it is possible that older iOS versions too may have been affected by this bug.

What is worrisome is that there is no way for the users to know if their Apple devices are being exploited using this vulnerability. "Besides a temporary slowdown of mobile mail application, users should not observe any other anomalous behavior. On iOS13, besides a temporary slowdown, it would not be noticeable. Failed attacks would not be noticeable on iOS 13 if another attack is carried afterwards and deletes the email," the company added in its blog post.

It also confirmed that at least targets including individuals from a Fortune 500 company in North America, an executive from a carrier in Japan, a VIP from Germany, MSSPs from Saudi Arabia and Israel, a journalist in Europe and an executive from a Swiss enterprise, have been targeted using this vulnerability.

Apple has acknowledge the vulnerability in iPhones and iPad. The company in a statement to Reuters has said that a fix for the bug has been developed and that it will be rolled out to Apple device owners soon.