3

First, I feel kind of dumb -- I know never to click on questionable links. But a friend* sent me an email message to my iPhone 11 (iOS 17.4.1) with a link to a website with a picture of them. They're reasonably well known, so I thought, well, it could be, so I clicked.

Safari brought up a screen saying the site was questionable. For some reason (fatigue?) I clicked on the link that said "show IP address" (I think that is what it said). I clicked on that and Safari showed a blank grey screen and said (as best I remember it) "can't open the site". I don't know, of course, with 100% certainty that this was Safari saying this, or whether it was the spoof site. Safari also offered me (at the top of the screen) the chance to "reduce protection" (I have whatever enhanced protection the latest iOS offers enabled). This is a legitimate thing Safari does sometimes when a site won't load. I don't believe I clicked "reduce protection".

At that point the blindingly obvious made it's way through to me: that this site was bad. I quickly closed the tab. (The speed with which I did all of this, including backing out of the whole thing, is the reason I'm so vague when I describe my actions above: the whole thing lasted 10 seconds).

Clearly this was an attempt to do something questionable to me. I know that on my computer I can run an anti-virus check program. But I have no idea how much risk I am at on my iPhone. And how to check to make sure nothing made its way down to me. Given my memory of what happened, it seems unlikely that anything happened, since it seems I never made a full connection to the site. But I can't be sure.

Since my entire world is on my phone, I'd like to be sure that all is well. What, if anything, can I do, to make sure all is well. Is there any anti-virus software I should run, or does iOS provide its own protection? I have Apple Pay on the phone. Is there any way to "hack" into that? (Forgive my ignorance -- I am a programmer, so not un-tech-savvy, but cybersecurity and payment schemes are beyond my paygrade).

*Narrator: "It wasn't his friend" :-)

1
  • 1
    Unless the phone is jailbroken or you are a person of interest to the intelligence services or law-enforcement agencies of a major government, there is no realistic chance that the phone is infected with malware. If you're not willing to take the risk, there are different levels at which you could take action. For example, you could restore from a backup made before the incident. Or, you could restore the whole system in Device FIrmware Update (DFU) mode. Or you could just destroy it and get a new one. None of those responses is really reasonable, but you may feel otherwise.
    – Linc D.
    Apr 20 at 21:25

1 Answer 1

4

Security wasn’t compromised

By clicking on Reduce Advanced Privacy Protections you would have turned off the security features that prevent websites from tracking you or fingerprinting your device to identify the device type, OS, browser, etc. Apple talks about these features here

While obviously not a desirable outcome, it’s very unlikely anything malicious was installed. Note that there was existing vulnerabilities/exploits that would allow installation of malware without user interaction, however they have since been mitigated as of early 2019. Below is a table summarizing these exploits.

Exploit iOS ver. Affected/Patched Patch Date
CVE-2017-2505 10.0 / 10.3.2 3/11/2017
CVE-2017-7064 10.3 / 10.3.3 7/19/2017
CVE-2018-4122 11.0 / 11.3 3/29/2018
185694 * 11.3 / 11.4.1 7/9/2018
CVE-2018-4438 11.4.1 / 12.1.1 12/5/2018
CVE-2018-4442 12.0 / 12.1.1 12/5/2018
191731 * 12.1.1 / 12.1.3 1/22/2019

Source: Project Zero JSC Exploits

* WebKit bug ID provided as CVE is not currently known.

What, if anything, can I do, to make sure all is well. Is there any anti-virus software I should run, or does iOS provide its own protection? I have ApplePay on the phone. Is there any way to "hack" into that?

The good news is that to download/install anything (currently), the user must take action to facilitate. Since you didn’t take action, nothing got installed. Unless jailbroken, nothing can be side loaded on to your device either. Only App Store apps can be installed. That said, to be proactive, I would flush my browser cache and delete cookies to ensure all traces are removed.

As far as Apple Pay goes, unless you installed some sort of remote access app onto your phone, Apple Pay is secure. You definitely can’t hack it by lowering identity protection in Safari.

TL;DR

Seven years ago (2017) you’d have something to worry about as there were known vulnerabilities in WebKit that allowed the unattended installation of malware. However, those bugs have been mitigated since iOS 12.1.3; a version of iOS that is now obsolete.

Additionally, per Project Zero…

The exploits we found did not include a bypass for PAC enabled devices and instead bailed out if they ran on an A12 device.

Basically, if you’re using an iPhone XS or newer with an A12 or later chip, this is a moot issue.

Clean your cache and cookies and you should be fine. If you’re still concerned, a reinstall of iOS is about the surest way to ensure noting was installed but I highly doubt that step is necessary.

3
  • 4
    -1 This is incorrect, (even untargeted) zero day exploits have been used in e.g. 2019 to install malware to iphones simply by visiting a website in Safari (source: googleprojectzero.blogspot.com/2019/08/… ). Although the chance of this happening to the OP is incredibly small, it's just not correct to categorically say nothing was installed as it's near impossible to determine that. The 2019 attack had been going on for years before it was found. Apr 21 at 8:52
  • 1
    @DavidMulder, while I could have worded this better, every one of the exploits that affect Safari are on 1) obsolete versions of iOS (iOS 10 thru 12) and 2) have been patched since 2019 and as early as 2018. This is according to the write up you provided.
    – Allan
    Apr 21 at 20:21
  • The point is that the 2019 attack had been going on for years before it was found, and you don't know what attacks are currently going on. Probably all/most attacks are used for high profile targets, but that's not a guarantee. The linked attack was public because it was found by Project Zero, whilst many exploits simply get sold to exploit traders (that typically sell them to governments). Apr 22 at 5:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .