Indian Government Issues "High Risk" Warning to Apple Users

• Image Credit: Google

• Apr 3, 2023 | Dhupali Das

Apple's iPhone is the company's most popular product, and most of us are familiar with it solely through its smartphone...

Digital Desk: Apple's iPhone is the company's most popular product, and most of us are familiar with it solely through its smartphone. But did you know that Apple is also one of the largest watch manufacturers in the world, and millions of people use the Apple Watch every day. Apple Watch shares the majority of its data and functions with iPhones. The smartwatch collects some of our most private data, which is why Apple releases watchOS updates on a regular basis to keep users safe. Although Apple suggests that users install the most recent builds of watchOS on their Apple Watch in order to have a more secure and feature-rich operating system, older Watch models are unable to install the most recent updates due to hardware limitations. Some users prefer to run older versions of watchOS for ease of use, but it's worth mentioning that older watchOS versions are simpler to hack. The Indian government has issued a warning for Apple Watch owners after detecting one such vulnerability in the Apple watchOS. 

The Indian Computer Emergency Response Team (CERT-In) of the Ministry of Electronics and Information Technology revealed that multiple vulnerabilities in Apple products have been reported, which could allow an attacker to bypass Privacy preferences, execute arbitrary code with kernel privileges, gain access to sensitive information, and spoof user interface on the targeted system. The flaw affects all watchOS versions prior to 9.4.

According to CERT-In, these vulnerabilities exist in Apple tvOS and watchOS products due to flaws in AppleMobileFileIntegrity, Identity Services, Podcasts, TCC, Find My, Shortcuts, and WebKit; out-of-bounds read in Core Bluetooth and ImagelO; improper memory handling in CoreCapture, Fontarser, and ImagelO; arbitrary code execution in Foundation; arbitrary code with kernel privileges in Kernel; bypass Same Origin incorrect input checking in Imagelo; and incorrect input sanitization in Calendar.

Successful exploitation of these vulnerabilities could enable an attacker to bypass Privacy preferences, run arbitrary code with kernel privileges, gain access to private information, and spoof the user interface on the targeted system.

To prevent being deceived install the most recent watchOS 9.4 as soon as possible.