Yet another iOS Zero-Day Exploit Chain Apple never caught https://cybersecuritynews.com/ios-zero-day-exploit-chain-leveraged/
Note that there are so many holes in iOS, that this chain exploited three zero-day holes in a row - which proves Apple is incompetent at QA testing.
The main reason Apple doesn't catch these is Apple only advertises
security. There never was security on an iPhone. It's all propaganda.
This newly disclosed chain of flaws is a chain of three iOS zero-day vulnerabilities that let attackers go from a single Safari link click to
full spyware control of an iPhone.
Stage 1 - Safari Remote Code Execution
Vulnerability: CVE-2023-41993
Method: Malicious link opened in Safari
Result: Attacker gains arbitrary read/write access inside Safari process
Tool: JSKit framework used to run native code
Stage 2 - Sandbox Escape and Kernel Privilege Escalation
Vulnerabilities: CVE-2023-41992 and CVE-2023-41991
Method: Exploit breaks out of Safari sandbox
Result: Attacker escalates privileges to kernel level
Codename: PREYHUNTER
Stage 3 - Spyware Deployment
Payload: Predator spyware modules
Components: Helper and Watcher modules
Capabilities: Record VoIP calls, capture camera and microphone,
log keystrokes, hide notifications
Stealth: Stops if security tools or analysis are detected
Note that the only people who think iOS is secure are people who know nothing, especially since Google proved iOS code has NEVER been tested!
If you’ve got an argument beyond “Apple is incompetent because zero‑days
exist,” make it. Otherwise you’re just turning normal security research into a
conspiracy theory.
On 12/05/2025 07:44, Brock McNuggets wrote:
If youve got an argument beyond 'Apple is incompetent because zero-days
exist,' make it. Otherwise you're just turning normal security research into a
conspiracy theory.
I think his argument is Apple is no more secure, and maybe less so than
any other OS despite what people have been told.
On 12/05/2025 07:44, Brock McNuggets wrote:
If you’ve got an argument beyond “Apple is incompetent because zero‑days
exist,” make it. Otherwise you’re just turning normal security research into a
conspiracy theory.
I think his argument is Apple is no more secure, and maybe less so than
any other OS despite what people have been told.
badgolferman wrote:
On 12/05/2025 07:44, Brock McNuggets wrote:
If you’ve got an argument beyond 'Apple is incompetent because zero-days >>> exist,' make it. Otherwise you're just turning normal security research into a
conspiracy theory.
I think his argument is Apple is no more secure, and maybe less so than
any other OS despite what people have been told.
Bingo!
On 12/05/2025 07:44, Brock McNuggets wrote:
If you’ve got an argument beyond “Apple is incompetent because
zero‑days exist,” make it. Otherwise you’re just turning normal
security research into a conspiracy theory.
I think his argument is Apple is no more secure, and maybe less so
than any other OS despite what people have been told.
On 12/05/2025 07:44, Brock McNuggets wrote:
If you’ve got an argument beyond “Apple is incompetent because zero‑days
exist,” make it. Otherwise you’re just turning normal security research into a
conspiracy theory.
I think his argument is Apple is no more secure, and maybe less so than
any other OS despite what people have been told.
On Dec 4, 2025 at 9:47:11 PM MST, "Marian" wrote <10gto4f$202m$1@nnrp.usenet.blueworldhosting.com>:
Yet another iOS Zero-Day Exploit Chain Apple never caught
https://cybersecuritynews.com/ios-zero-day-exploit-chain-leveraged/
Note that there are so many holes in iOS, that this chain exploited three
zero-day holes in a row - which proves Apple is incompetent at QA testing. >>
The main reason Apple doesn't catch these is Apple only advertises
security. There never was security on an iPhone. It's all propaganda.
This newly disclosed chain of flaws is a chain of three iOS zero-day
vulnerabilities that let attackers go from a single Safari link click to
full spyware control of an iPhone.
Stage 1 - Safari Remote Code Execution
Vulnerability: CVE-2023-41993
Method: Malicious link opened in Safari
Result: Attacker gains arbitrary read/write access inside Safari process
Tool: JSKit framework used to run native code
Stage 2 - Sandbox Escape and Kernel Privilege Escalation
Vulnerabilities: CVE-2023-41992 and CVE-2023-41991
Method: Exploit breaks out of Safari sandbox
Result: Attacker escalates privileges to kernel level
Codename: PREYHUNTER
Stage 3 - Spyware Deployment
Payload: Predator spyware modules
Components: Helper and Watcher modules
Capabilities: Record VoIP calls, capture camera and microphone,
log keystrokes, hide notifications
Stealth: Stops if security tools or analysis are detected
Note that the only people who think iOS is secure are people who know
nothing, especially since Google proved iOS code has NEVER been tested!
Yeah, that exploit chain was real — three zero‑days (41993, 41992, 41991) chained together so a single malicious Safari link could lead to full device compromise. Predator spyware used it in the wild. Apple patched the issues once researchers disclosed them.
But that still doesn’t prove the whole platform is worthless. Every major OS
has zero‑days, including Android and Chrome. What this shows is the obvious:
iOS isn’t magically unbreakable and never has been. Skilled attackers can and
do find holes, and patches matter.
If you’ve got an argument beyond “Apple is incompetent because zero‑days
exist,” make it. Otherwise you’re just turning normal security research into a
conspiracy theory.
badgolferman <REMOVETHISbadgolferman@gmail.com> wrote:
On 12/05/2025 07:44, Brock McNuggets wrote:
If you’ve got an argument beyond “Apple is incompetent because zero‑days
exist,” make it. Otherwise you’re just turning normal security research into a
conspiracy theory.
I think his argument is Apple is no more secure, and maybe less so than
any other OS despite what people have been told.
That may be his argument. Yet all he has are anecdotes, hyperbole and cherry-picked information.
I think his argument is Apple is no more secure, and maybe less so than
any other OS despite what people have been told.
That may be his argument.
Yet all he has are anecdotes, hyperbole and cherry-picked information.
Chris wrote:
I think his argument is Apple is no more secure, and maybe less so than
any other OS despite what people have been told.
That may be his argument.
It is my argument.
Yet all he has are anecdotes, hyperbole and cherry-picked information.
<https://www.cs.umd.edu/~dml/papers/wifi-surveillance-sp24.pdf>
"In this work, we show that Apples WPS implementation
can easily be abused to create a serious privacy threat
on a global scale."
<https://arxiv.org/abs/2405.14975>
"In this work, we show that Apple's flawed WPS can too easily be abused"
<https://www.govinfosecurity.com/surveillance-risk-apples-wifi-based-positioning-system-a-25330>
"The attack risk stems from Apple's WiFi-based Positioning System, or WPS"
<https://securityboulevard.com/2024/05/apple-wi-fi-location-privacy-richixbw/>
"An unrestricted Apple API endpoint allows for easy tracking."
<https://cybernews.com/privacy/apple-beams-wifi-location-data-privacy-risk/>
"Anyone can exploit Apple's flawed WiFi-based positioning system (WPS)*
<https://www.macworld.com/article/2343297/apple-wi-fi-network-wps-vulnerability-location-services-leak.html>
"Researchers have discovered a crucial vulnerability
in the way only Apple's location services work"
<https://www.theregister.com/2024/05/23/apple_wifi_positioning_system/>
"The threat applies even to users that do not own devices
for which the WPSes are designed - individuals who own no Apple
products, for instance, can have their AP in Apple's WPS merely
by having Apple devices come within Wi-Fi transmission range."
<https://9to5mac.com/2024/05/24/apple-location-services-vulnerability/>
"There is one crucial difference between the way in which
Apple and Google devices carry out this task
and that's exactly where the privacy issue arises."
"We need to understand Apple devices figure out locations differently"
<https://www.bizcommunity.com/article/apple-may-have-turned-wi-fi-routers-into-a-privacy-threat-239637a>
"Researchers from the University of Maryland have uncovered a
significant privacy vulnerability in Apple's Wi-Fi-based
Positioning System (WPS). This vulnerability enables attackers
to track devices globally by exploiting the way Apple's WPS
operates, raising serious privacy concerns."
<https://cyberinsider.com/apples-wi-fi-based-positioning-system-is-a-privacy-nightmare/>
*Apple's Wi-Fi-Based Positioning System is a Privacy Nightmare*
"Researchers from the University of Maryland have uncovered a
significant privacy vulnerability in Apple's Wi-Fi-based Positioning
System (WPS). This vulnerability enables attackers to track devices
globally by exploiting the way Apple's WPS operates, raising
serious privacy concerns."
| Sysop: | DaiTengu |
|---|---|
| Location: | Appleton, WI |
| Users: | 1,089 |
| Nodes: | 10 (0 / 10) |
| Uptime: | 153:50:24 |
| Calls: | 13,921 |
| Calls today: | 2 |
| Files: | 187,021 |
| D/L today: |
3,754 files (944M bytes) |
| Messages: | 2,457,163 |