Apple's s App Had a Security Flaw That Exposed s to Phishing Attacks for Three Months 374wl Technology News

Apple's revised release notes for the iOS 18.2 update reveal that it patched two issues related to its s app. 3r2qx

Written by David Delima | Updated: 19 March 2025 15:30 IST

Apple's s App Had a Security Flaw That Exposed s to Phishing Attacks for Three Months

Photo Credit: Pexels/ Antoni Shkraba 66q1d

Apple introduced a standalone s app on iOS 18

Highlights

Apple fixed two flaws with its s app on iOS 18.2
iOS 18.1 rolled out to s in December 2024
Apple has updated its release notes to detail the security fixes

ment

Apple released a dedicated s app last year, as part of the iOS 18 software update. Instead of a menu inside the Settings app, s can access their s and other details via a standalone app. However, the s app had a serious security flaw that exposed s to potential phishing attacks from attackers who were on the same Wi-Fi network. The company recently disclosed that it fixed the security flaw three months after iOS 18 was released.

Apple Fixed s App Vulnerability With iOS 18.2 Update 322te

The iPhone maker recently amended its release notes (via 9to5Mac) for the iOS 18.2 update, which was released in December. The document now includes two entries, both titled 's', that describe fixes for the app. Apple has credited Mysk security researchers Talal Haj Bakry and Tommy Mysk with identifying the security vulnerability.

According to the company's updated document, the first patch for the s app on iOS 18.2 fixed two flaws that allowed a in a privileged network position to leak sensitive information, and alter network traffic.

The Mysk researchers discovered that Apple's s app wasn't using encrypted connections (HTTPS) when fetching details of specific sites, such as site icons. Similarly, reset pages were loaded over HTTP.

The same flaw would allow an attacker on the same Wi-Fi network to intercept the network request, and direct the device to load a phishing website instead of the legitimate one. If the trusts the webpage, they might enter their credentials on the fraudulent website.

The cybersecurity firm reported the issue to Apple in September, and Apple's revised document reveals that it rolled out fixes for the issue with iOS 18.2 in December. Eligible iPhone and iPad models that are running on iOS 18.2 and iPadOS 18.2 or newer versions should not be vulnerable to the flaw.

Comments

For the latest reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: Apple

David Delima

Email David Delima

As a writer on technology with Gadgets 360, David Delima is interested in open-source technology, cybersecurity, consumer privacy, and loves to read and write about how the Internet works. David can be ed via email at [email protected], on Twitter at @DxDavey, and Mastodon at mstdn.social/@delima. More