Apple Patches Passwords App Security Flaw

Apple has addressed a security vulnerability in its Passwords app that exposed users to potential phishing attacks for approximately three months. The flaw existed from the initial release of iOS 18 until the release of the iOS 18.2 update.

The vulnerability allowed attackers on the same Wi-Fi network to intercept unencrypted requests made by the Passwords app. These requests were for the logos and icons displayed next to saved website credentials. By redirecting these requests, attackers could potentially lead users to fake login pages and steal their usernames and passwords.

According to Apple’s security update, “A user in a privileged network position may be able to leak sensitive information.” The company resolved the issue by ensuring HTTPS encryption is used when the Passwords app transmits information over a network.

Security researchers at Mysk first discovered and reported the vulnerability in September. The flaw also affected macOS, iPadOS, and visionOS, and Apple has released corresponding security updates for these platforms as well.

Users are strongly encouraged to update their Apple devices to iOS 18.2 or later to ensure their passwords are protected.

Source: The Verge

Keywords: Apple, Passwords app, security vulnerability, phishing, iOS 18.2, Mysk, encryption, HTTPS, security update