Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Apple Ships iOS 15 with MFA Code Generator

Apple on Monday rolled out a major refresh of its flagship iOS mobile platform, adding a built-in two-factor authentication code generator and multiple anti-tracking security and privacy features.

Apple on Monday rolled out a major refresh of its flagship iOS mobile platform, adding a built-in two-factor authentication code generator and multiple anti-tracking security and privacy features.

The iOS 15 makeover also includes patches for at least 22 documented security vulnerabilities, some serious enough to expose iPhone and iPad users to remote denial-of-service and local code execution attacks.

The latest mobile operating system refresh comes on the heels of two major security and privacy-related controversies at Apple. The company was forced to scramble out an emergency iOS patch last week to address in-the-wild zero day attacks and Apple was also caught in a privacy scandal linked to its now-delayed sex-abuse scanning technology.

[ READ: Apple Ships Urgent Patch for FORCEDENTRY Zero-Days ]

According to Apple, the built-in authenticator can generate verification codes needed for additional sign-in security. “If a site offers two-factor authentication, you can set up verification codes under Passwords in Settings — no need to download an additional app. Once set up, verification codes autofill when you sign in to the site.”

Another notable is Mail Privacy Protection, a new feature that prevents e-mail marketers from learning information about an iPhone user’s Mail activity.

“If you choose to turn it on, it hides your IP address so senders can’t link it to your other online activity or determine your location. And it prevents senders from seeing if you’ve opened their email,” Apple explained.

The iOS 15 upgrade also includes nifty privacy features like Secure Paste, an App Privacy report that exposes how often apps access a user’s location, photos, camera or microphone over a seven-day stretch.   

Advertisement. Scroll to continue reading.

[ READ: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks ]

On the patching front, Apple documented 22 vulnerabilities fixed in iOS 15 and iPad OS 15 and warned that these issues could lead to code execution, denial of service, or authentication bypass attacks.

The most serious of these flaws could allow arbitrary code execution via rigged fonts or image files.  Apple also warned that of the security defects could allow a 3D model constructed to look like the enrolled user to authenticate via Face ID.

Apple is gently nudging iPhone and iPad users to apply the upgrades via a ribbon below the Software Update settings page.

Related: New iOS Zero-Click Exploit Defeats Apple ‘BlastDoor’ Sandbox 

Related: Apple Patches ‘Actively Exploited’ Mac, iOS Security Flaw

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.

Register

People on the Move

DARPA veteran Dan Kaufman has joined Badge as SVP, AI and Cybersecurity.

Kelly Shortridge has been promoted to VP of Security Products at Fastly.

After the passing of Amit Yoran, Tenable has appointed Steve Vintz and Mark Thurmond as co-CEOs.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.