Another disgruntled analyst discloses zero-day iOS 15 bugs

Another developer claims to have done in one day, what Apple couldn’t do in six months

When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.

Exasperated atApple’s recent handling of its security bounty program, acybersecurityresearcher has released proof-of-concept (PoC) exploit code for three zero-day vulnerabilities iniOS 15.

The researcher, who is only known by the alias IllusionOfChaos, said his action is in response to Apple’s inaction to fix the vulnerabilities.

“I’ve reported four 0-day vulnerabilities this year between March 10 and May 4, as of now three of them are still present in the latest iOS version (15.0) and one was fixed in 14.7, but Apple decided to cover it up and not list it on the security content page,”wrotethe researcher.

We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.

Click here to start the survey in a new window«

The researcher added that while Apple initially apologized for their response, they later didn’t even respond to his email when he threatened to share details about the vulnerabilities within ten days.

Caught in red tape?

In the post, the researcher said that in their initial email Apple claimed the company failed to publicly acknowledge the vulnerabilities because of a “processing issue.”

“When I confronted them, they apologized, assured me it happened due to a processing issue and promised to list it on the security content page of the next update. There were three releases since then and they broke their promise each time,” shared the researcher.

IllusionofChaos then gave Apple ten days to explain the reason for the continued lethargy in fixing the bugs, warning them that the details will be shared post-expiry of the time frame. Since Apple didn’t respond, all the research has now been shared online.

Are you a pro? Subscribe to our newsletter

Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!

“My request was ignored so I’m doing what I said I would. My actions are in accordance with responsible disclosure guidelines (GoogleProject Zero discloses vulnerabilities in 90 days after reporting them to vendor, ZDI - in 120). I have waited much longer, up to half a year in one case,” the researcher reasons as he shared details of the vulnerabilities along with PoC exploit code for all of them.

Interestingly, an anonymous jailbreak developerclaims to have fixedall three vulnerabilities, barely a day after they were disclosed.

TechRadar Prohas contacted Apple for comment.

With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.

Should your VPN always be on?

3 reasons why PIA fell in our best VPN rankings

NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)