Security Flaw Found in iOS
A critical vulnerability has been discovered in iOS that allows malicious applications to access files belonging to other apps on iPhones, including sensitive private keys from cryptocurrency wallets. This issue affects iOS versions 26.7.1, 27.0.1, and 27.2. The flaw was uncovered by security researchers known as @forcequitOS and @0xjohnny on November 8, who also released a proof-of-concept exploit on GitHub. Although Apple released updates iOS 27.2.1 and 26.7.3 on November 9, these patches do not explicitly mention this vulnerability. Moreover, the problem persists in the initial beta of iOS 27.3.
Risks and Safety Advice
The threat primarily arises when users install apps from unverified sources outside the official App Store. Developer Christoph Kolbitz demonstrated a file manager capable of reading, modifying, and deleting data from other apps without requiring a jailbreak, by installing it through AltStore or SideStore. According to 23pds, Chief Information Security Officer at SlowMist, the risk only manifests if the user runs an untrusted app, especially when wallets store secrets in an unencrypted form.
Binance has urged its users to take immediate precautions:
- Remove any potentially dangerous applications,
- Update iOS and all installed apps to the latest versions.
If there's any suspicion of compromise, users are advised to transfer their funds to a new wallet on a secure device. Hardware wallets, which store keys offline, are not affected by this vulnerability and thus offer greater security compared to software wallets. Binance emphasized,
“This is an issue at the iOS level, not just Binance.”Additionally, researcher @forcequitOS criticized Apple for delaying its response:
“Apple dragged its feet in addressing this.”
This flaw highlights the crucial importance of downloading apps exclusively from trusted sources to minimize security risks—an especially vital practice for cryptocurrency users. Staying current with software updates and exercising caution regarding app origins can greatly reduce vulnerability to such attacks. The proactive stance of companies like Binance underscores the severity of the threat and the necessity for users to remain vigilant.
As the security landscape for iOS continues to raise concerns, it's essential to consider the broader implications of vulnerabilities on platforms like Binance. Recently, the exchange faced a significant breach, losing $6.34 billion, yet managed to recover a vast majority of the stolen assets. Understanding these incidents can provide users with valuable insights into protecting their digital assets. For a detailed account of this incident and its aftermath, check out our coverage on Binance's substantial losses and recovery efforts.