Apple on Monday rolled out a major refresh of its flagship iOS mobile platform, adding a built-in two-factor authentication code generator and multiple anti-tracking security and privacy features.
The iOS 15 makeover also includes patches for at least 22 documented security vulnerabilities, some serious enough to expose iPhone and iPad users to remote denial-of-service and local code execution attacks.
The latest mobile operating system refresh comes on the heels of two major security and privacy-related controversies at Apple. The company was forced to scramble out an emergency iOS patch last week to address in-the-wild zero day attacks and Apple was also caught in a privacy scandal linked to its now-delayed sex-abuse scanning technology.
[ READ: Apple Ships Urgent Patch for FORCEDENTRY Zero-Days ]
According to Apple, the built-in authenticator can generate verification codes needed for additional sign-in security. “If a site offers two-factor authentication, you can set up verification codes under Passwords in Settings — no need to download an additional app. Once set up, verification codes autofill when you sign in to the site.”
Another notable is Mail Privacy Protection, a new feature that prevents e-mail marketers from learning information about an iPhone user’s Mail activity.
“If you choose to turn it on, it hides your IP address so senders can’t link it to your other online activity or determine your location. And it prevents senders from seeing if you’ve opened their email,” Apple explained.
The iOS 15 upgrade also includes nifty privacy features like Secure Paste, an App Privacy report that exposes how often apps access a user’s location, photos, camera or microphone over a seven-day stretch.
[ READ: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks ]
On the patching front, Apple documented 22 vulnerabilities fixed in iOS 15 and iPad OS 15 and warned that these issues could lead to code execution, denial of service, or authentication bypass attacks.
The most serious of these flaws could allow arbitrary code execution via rigged fonts or image files. Apple also warned that of the security defects could allow a 3D model constructed to look like the enrolled user to authenticate via Face ID.
Apple is gently nudging iPhone and iPad users to apply the upgrades via a ribbon below the Software Update settings page.
Related: New iOS Zero-Click Exploit Defeats Apple ‘BlastDoor’ Sandbox
Related: Apple Patches ‘Actively Exploited’ Mac, iOS Security Flaw
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Backslash Snags $8M Seed Financing for AppSec Tech
- Oleria Scores $8M Seed Funding for ID Authentication Technology
- Aembit Scores $16.6M Seed Funding for Workload IAM Technology
- Project Zero: Samsung Mobile Chipsets Vulnerable to Baseband Code Execution Exploits
- Rapid7 Buys Anti-Ransomware Firm Minerva Labs for $38 Million
- Microsoft Pins Outlook Zero-Day Attacks on Russian Actor, Offers Detection Script
- Microsoft Warns of Outlook Zero-Day Exploitation, Patches 80 Security Vulns
- Adobe Warns of ‘Very Limited Attacks’ Exploiting ColdFusion Zero-Day
Latest News
- Backslash Snags $8M Seed Financing for AppSec Tech
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
- High-Severity Vulnerabilities Found in WellinTech Industrial Data Historian
- Chrome 111 Update Patches High-Severity Vulnerabilities
- BreachForums Shut Down Over Law Enforcement Takeover Concerns
- CISA Expands Cybersecurity Committee, Updates Baseline Security Goals
- Malware Trends: What’s Old Is Still New
- Burnout in Cybersecurity – Can It Be Prevented?
