Security updates for iPhones, iPads, Macs, Apple Watches, and Vision Pro just rolled out.

On Tuesday, Apple released security patches for iOS, iPadOS, MacOS, WatchOS, and VisionOS, which address wireless security flaws in Bluetooth pairing, AirPlay, and Messages.

According to Apple’s security notes, vulnerabilities can allow attackers to establish a Bluetooth connection without user interaction, bypass AirPlay connection rate limits, and join an iMessage group chat and receive its messages. Around half of these flaws were found internally by Apple, while the others were submitted by researchers.

You should update your devices now, as several generations are affected across device categories. The following software versions include patches:

Apple’s security notes list a fix for Messages to prevent attackers from remotely joining an iMessage group chat and reading its messages. According to Apple, “an authorization issue was addressed with improved validation” to fix the issue.

There was likely a flaw in Apple’s iMessage authorization logic that allowed an unauthorized user to inject themselves into a group chat roster without permission from an existing member. 

Another issue in Messages could allow an authorized added member to access messages within a group chat that were sent before they joined. According to Apple, the code that caused this issue has been removed.

One security fix across devices and software versions addresses an issue where a malicious actor could establish a Bluetooth connection to your device without user interaction.

Apple was not specific about which kind of Bluetooth attack this fix addresses; however, it’s reminiscent of Bluetooth Low Energy Re-Pairing vulnerabilities found earlier this year by French researchers.

Source link