Security Vulnerability in iPhone Mirroring on iOS 18 and macOS Sequoia

The Sevco security team discovered a vulnerability in the new 'iPhone Mirroring' feature, which allows the iPhone screen to be displayed on a Mac, causing user data to be exposed to employers. This is a new feature introduced by Apple on iOS 18 and macOS Sequoia.

When a user uses this feature, the Mac will create a folder containing information about the iPhone applications being used.

While the specific content of the app is not exposed, an attacker can still access the list of apps installed on the iPhone through automated network checks. This can pose a privacy risk, especially in a workplace environment where apps that employees use on their personal phones could be exposed to employers.

Sevco has notified Apple of the vulnerability and is advising users to temporarily stop using the iPhone Mirroring feature on their Macs at work until Apple releases a patch.

Exposing information about the applications installed on a user's iPhone can lead to serious consequences, such as:

Employers may be biased against employees based on the apps they use, such as dating apps, mental health apps, etc.

Certain applications may be restricted or banned in certain countries.

If found collecting employees' personal data without permission, employers could face legal trouble.

Hopefully Apple will fix this vulnerability soon to protect user privacy.

iOS 18 has a mysterious bug, iPhone reads user's passwords out loud

A serious vulnerability discovered in iOS 18 and iPadOS 18 allows the VoiceOver feature to read out stored passwords, threatening users' privacy and raising major information security concerns in the technology industry.

Identified as CVE-2024-44204, the bug is a logic flaw in the new password manager application. VoiceOver's ability to read a user's password could expose personal information, allowing unauthorized access to the account.

Multiple iPhone and iPad models, including the iPhone X and iPad models like the iPad Pro and iPad Air from the third generation onwards, are affected by this bug.

To fix this serious bug, Apple quickly released iOS 18.0.1 and iPadOS 18.0.1 updates. At the same time, the company also confirmed that it had implemented more rigorous testing measures to ensure that VoiceOver was no longer able to read users' passwords.

In addition to the VoiceOver bug, the iOS 18 release also had a number of other issues, such as the CVE-2024-44207 bug affecting the new iPhone 16 models that allowed voice messages to be recorded without notifying the user that the microphone was active. Fortunately, this issue has been fixed.

The VoiceOver vulnerability was discovered by independent researcher Bistrit Daha. The emergence of these vulnerabilities underscores the importance of users keeping their devices up to date and shows the value of independent security audits in detecting and fixing such issues.