A Message about iOS Security (apple.com)

Article summary

Apple released a statement about iOS security in response to a report by Google's Project Zero about a sophisticated attack on iPhones. The attack was narrowly focused on a small number of websites related to the Uighur community. Apple claims that the media overhyped the vulnerabilities and that they were already in the process of fixing the bugs when Google approached them. The company also emphasized that the attack was not a broad-based exploit of iPhones.

Main themes

• iOS security
• Google Project Zero
• Vulnerability disclosure
• Apple's response
• Media hype
• Nation-state attacks

What commenters say

• The media overhyped the severity of the iOS vulnerabilities, creating a false impression of mass exploitation.
• The attack was a serious vulnerability that could have been used to target a large number of people, and Apple's downplaying of the issue is not justified.
• Apple's response to the vulnerability report was defensive and accusatory, which may damage their relationship with security researchers.
• Google's Project Zero is motivated by a desire to improve security, but also has a vested interest in making their discoveries as newsworthy as possible.
• Apple should be thanking Google for bringing the vulnerability to their attention, rather than responding defensively.
• The disclosure of the vulnerability timeline was incomplete, and both the time the bug existed and the relevant timeframe of known exploits should be disclosed.
• The attack highlights the risks of nation-state attacks on minority groups, and the need for greater transparency and cooperation between companies and security researchers.