Episode 10

bonus
Published on:

8th Sep 2023

Security Update: Urgent iOS Update Alert for iPhone Users

Attention iPhone users! Apple has just released an emergency update, iOS 16.6.1, which addresses two critical vulnerabilities that have been actively exploited in real-world scenarios. Here's what you need to know:

  1. The Flaws: The first vulnerability is associated with ImageIO, identified as CVE-2023-41064. This flaw could let attackers execute malicious code through a specially crafted image. The second vulnerability is linked to Apple's Wallet, labeled as CVE-2023-41061. This could allow attackers to execute code via a malicious attachment. Apple has confirmed that both these issues have been actively exploited.
  2. Real-Life Implications: These vulnerabilities aren't just theoretical. They've been used in real-life attacks to deploy spyware without any user interaction. Notably, the infamous Pegasus spyware, which grants attackers full access to iPhones, has been linked to these flaws. Citizen Lab, a security research group, discovered an exploit named "BLASTPASS" that compromised iPhones running iOS 16.6 without any user interaction.
  3. Why Update Now: Given the severity of these vulnerabilities, it's crucial to update to iOS 16.6.1 immediately. Even if you believe you're not a direct target, the more these flaws are known, the higher the risk of them being used maliciously. Independent security researcher, Sean Wright, emphasizes the importance of updating promptly. For those concerned about potential compromises, tools like iVerify can be used to check device security. Additionally, Apple's Lockdown Mode can be activated for those at higher risk, though it does limit device functionality.
  4. Broader Impacts: It's not just iPhones. The Wallet vulnerability is also present in Apple Watch, and the ImageIO issue has been addressed in a new Mac update. Ensure all your Apple devices are updated for maximum security.
  5. How to Update: Even if you've set your iPhone for automatic updates, it's recommended to manually check and update to ensure you have the latest protection. Navigate to iPhone Settings > General > Software Update and install iOS 16.6.1.

Listeners, in the ever-evolving world of technology, staying updated is not just about getting the latest features; it's about ensuring your personal security. Always prioritize updates, especially those addressing security concerns.

---

I do hope you enjoyed this episode of the podcast. Here's some helpful resources including any sites that were mentioned in this episode.

--

Sites Mentioned in this Episode

--

Find subscriber links on my site, add to your podcast player, or listen on the web players on my site:

Listen to Byte Sized Security

--

Support this Podcast with a Tip:

Support Byte Sized Security

Next Episode All Episodes Previous Episode

Support the Podcast with a Tip

If you're enjoying Byte-Sized Security and finding these practical tips useful, please consider supporting the podcast with a small contribution. It costs $17 per month just to cover podcast hosting fees, and your support helps offset the costs of producing this security resource and keeping episodes free. Even a tip of $1-5 per month from loyal listeners adds up and allows me to continue providing great cybersecurity info. Please considering a donation. I appreciate you helping sustain Byte-Sized Security! Now back to the security tips..
Support the Podcast
A
We haven’t had any Tips yet :( Maybe you could be the first!

Listen for free

Show artwork for Byte Sized Security

About the Podcast

Byte Sized Security
Quick cyber tips you can act on before your coffee goes cold
Byte Sized Security takes one security or privacy story and cuts it down to something you can act on before your coffee goes cold. Host Marc David, a CISSP and Staff Security Engineer, keeps each episode short, usually about 6 to 11 minutes, with the facts, the primary sources, and a practical next step.

The show is part of ByteSizedSecurity, a 501(c)(3) cybersecurity education nonprofit. Listen and find the show notes at https://bytesizedsecurity.show
Support This Show

About your host

Profile picture for Marc David

Marc David

Marc David is a CISSP-certified Staff Security Engineer with 8+ years in dedicated security roles inside regulated healthcare, and the host of Byte-Sized Security. He describes his work in one line: "I get security tooling adopted by engineering teams who do not report to me." Most security programs fail at adoption, not at tool selection. Marc has driven API security monitoring, device trust, browser-based data loss prevention, and continuous mobile penetration testing to full coverage across engineering, IT, and platform groups where he holds no authority over anyone. His background spans HIPAA, HITRUST, and SOC 2 compliance, security automation, and awareness training built for people who never wanted training. Marc lives in the San Francisco Bay Area and speaks on security adoption, healthcare compliance, and automation.