CISA adds 3 iOS flaws to its catalog of known exploited vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive for federal agencies to address three critical vulnerabilities in iOS that have been exploited in targeted hacking efforts over the last ten months. These vulnerabilities were detailed in a report released by Google, which shed light on the ongoing hacking campaigns by three separate groups. All three campaigns leveraged a sophisticated hacking toolkit named Coruna, which compiled a total of 23 distinct iOS exploits into five powerful exploit chains. Although some of these vulnerabilities had previously been exploited as zero-days in earlier, unrelated attacks, they were patched by the time Google observed their use in conjunction with Coruna. However, even against older versions of iOS, the toolkit represents a significant threat due to the advanced nature of its exploit code and diverse capabilities. Google researchers highlighted that the true value of this exploit kit lies in its thorough collection of iOS exploits, which come with detailed documentation, including comments written in fluent English. The most sophisticated exploits utilize non-public techniques for exploitation and methods to bypass existing security measures. On Friday, CISA added these vulnerabilities to its official catalog of known exploited vulnerabilities, mandating that all federal agencies under its jurisdiction implement patches. The agency also recommended that all organizations follow suit to mitigate potential risks. The vulnerabilities affect iOS versions 13 through 17.2.1, while versions beyond 17.2.1 are not susceptible. Importantly, these exploits do not activate if Apple Lockdown mode is enabled or if a browser is set to private browsing. Among Coruna's advanced features is an unprecedented JavaScript framework that employs a distinctive obfuscation technique to evade detection and reverse engineering. When activated, this framework initiates a fingerprinting module to collect device information, which then determines the appropriate WebKit exploit to deploy, along with a bypass for a defense mechanism known as pointer authentication code.