Forgot your password?
typodupeerror
IOS Iphone Security

iPhone Exploit DarkSword Steals Data In Minutes With No Trace (nerds.xyz) 85

BrianFagioli writes: A new iOS exploit chain called DarkSword shows how attackers can break into certain iPhones, grab sensitive data like messages, credentials, and even crypto wallets, and then disappear without leaving obvious traces. It targets older iOS 18 builds using Safari and WebGPU flaws to escape Apple's sandbox, which is pretty wild on its own, but what really stands out is how fast it works and how financially motivated these attacks have become. The takeaway is simple but important, update your iPhone ASAP and don't assume mobile devices are somehow safer than desktops anymore.
This discussion has been archived. No new comments can be posted.

iPhone Exploit DarkSword Steals Data In Minutes With No Trace

Comments Filter:
  • How about we present the message: recycle old devices that cannot be updated anymore?

    Apple does not back port all fixes. They only fully update their latest OS.

    • Re: (Score:1, Insightful)

      by drinkypoo ( 153816 )

      How about we present the message: recycle old devices that cannot be updated anymore?
      Apple does not back port all fixes. They only fully update their latest OS.

      How about we stop allowing corporations to do that? They are legal fictions which exist at the pleasure of The People, and if we stop bending over for them, we can bring them to heel. They should not be allowed to abandon devices they could easily support when any significant number of people are still using them. The only reason corporate charters are supposed to exist is to serve the public interest.

      • by Moridineas ( 213502 ) on Thursday March 19, 2026 @08:49AM (#66049428) Journal

        How about we stop allowing corporations to do that? They are legal fictions which exist at the pleasure of The People, and if we stop bending over for them, we can bring them to heel. They should not be allowed to abandon devices they could easily support when any significant number of people are still using them. The only reason corporate charters are supposed to exist is to serve the public interest.

        According to Apple, as of February 2026, 90% of all currently running iOS devices are on either iOS 26 (current release) or iOS 18 (previous release), while 10% are running something earlier.

        iOS 15, 16, and 17 covers ~10% of all iOS users and are all actively patched for security bugs. (Presumably there is a tiny fraction of people running something before iOS 15.)

        iOS 15 supports iPhone 6s devices first released in 2015.

        So, Apple is supporting their iPhone hardware for at least 11 years right now.

        Now, how much further would you, Drinkypoo, force them to make updates for? Should it go all the way back to iOS 1 in 2007? Sure, only a few hobbyists may be running those devices, but what does that matter. Does your dictat apply to all companies that release software packages? Should every company that has ever released a piece of software be forced to patch _every revision level_, separately, forever? How do you define what they could "easily support" and "any significant number of people"? I'm really curious how you imagine your system working. It sure sounds like it would put a lot of small and open source developers out of business.

        • Now, how much further would you, Drinkypoo, force them to make updates for?

          Which word in "They should not be allowed to abandon devices they could easily support when any significant number of people are still using them" confused you? No, don't tell me. Look it up.

          • Sure, since you missed it in my post, here's what I already asked you:

            How do you define what they could "easily support" and "any significant number of people"? I'm really curious how you imagine your system working. It sure sounds like it would put a lot of small and open source developers out of business.

            From your post, directly replying to OP about Apple, it's clear that you believe Apple is egregiously guilty of breaking your rules and "we [need to] stop bending over for them, we [need to] bring them to heel." (Nice.) Apple currently supports 11+ years of devices and 5 major OS software revisions. Well under 1% of iOS users are running something that is not currently supported.

            So, what can Apple "easily support" that they are not curren

            • Apple currently supports 11+ years of devices and 5 major OS software revisions.

              First, both of those numbers are irrelevant. If Apple is popular then there will be more devices to support. Second, Apple doesn't support all of those revisions on all devices. Third, Apple can easily support all of the devices, because they have all of the necessary information. Fourth, stop asking stupid questions, you're exactly like the people saying "how much do you think a living wage is" when that's completely beside the point of the argument.

              • by Moridineas ( 213502 ) on Thursday March 19, 2026 @10:22AM (#66049612) Journal

                So, you jump into a thread specifically about Apple supporting old devices but next you say "numbers are irrelevant" when they don't match your narrative. You make bombastic claims like "if we stop bending over for them, we can bring them to heel. They should not be allowed to abandon devices they could easily support when any significant number of people are still using them" but won't even attempt to articulate what your demand actually is. Seemingly, supporting 11+ year old devices and 5 major OS revisions is not sufficient. Forget Apple, if that gets your dander up, support is an issue for almost all developers.

                Your statement has real costs that must be born by someone. Supporting more than a decade of devices (with multiple device releases each year) and five OS revisions (and maintaining build systems, testing systems and staff, etc.) is not a simple operation.

                Regulations are very easy to impose through anti-corporate diatribes, when you ignore costs and consequences.

              • Apple currently supports 11+ years of devices and 5 major OS software revisions.

                First, both of those numbers are irrelevant. If Apple is popular then there will be more devices to support. Second, Apple doesn't support all of those revisions on all devices. Third, Apple can easily support all of the devices, because they have all of the necessary information. Fourth, stop asking stupid questions, you're exactly like the people saying "how much do you think a living wage is" when that's completely beside the point of the argument.

                Any Device that can run a Certain Major Version of an Apple OS, can run any Minor Revisions within that Version. So, e.g., iOS 18.x.x.x would be supported. Consequently, Apple wisely Updates only the Highest Revision within a Major Version it intends to Support. Anything else would lead to nearly infinite Regression Testing!

        • by ddtmm ( 549094 )
          Wow, you told him
        • Now, how much further would you, Drinkypoo, force them to make updates for?

          I am not drinkypoo, obviously; however, his point is sound and the way to resolve the issue is for every abandoned device that someone may own, full schematics and source code should be provided immediately upon abandonment.

          Don't want to release that info? Then don't abandon security updates.

          The default answer that you provide basically says, "fuck the consumer, the business is more important", but I have to ask, is it really more important? The business can not exist without consumers, so the consumer is a

        • by xpyr ( 743763 )
          Open source any iOS version that apple no longer wants to support and then the open source community can decide to take over and do releases from there. If any company that makes hardware and the software that runs on it, when they no longer want to support it, they can open source the hardware and software.
      • by 2TecTom ( 311314 )

        Sadly, we cannot stop them any longer, they have become to powerful. Corporations may be legal fiction however classism and corruption are not. Given that the upper class owns the governments and the courts, there is no effective way to constrain transnational corporations. Indeed, such legal machinations were designed to allow the upper class to act with impunity. This is how the entitled turned our democracies into thier global plutocracy.

        This always ends the same way, an internal ethical rot that destroy

    • I just received an iOS 16 patch for my iPhone 8 yesterday. This model was released in 2017.

    • Apple does not back port all fixes.

      And you know this ... How, exactly ?

      My ten year old iphone SE first gen is capped on ios 15. It just received a security update this week.

      That's TEN YEARS of support for security updates.

    • You working for Apple? We don't need cell phones every two years anymore. Our throwaway society is costly

    • How about we present the message: "it is fraud to advertise a device as suitable for use on the internet unless you are committing to fixing any critical security flaws found on it for the lifetime of that device".
      • How about we present the message: "it is fraud to advertise a device as suitable for use on the internet unless you are committing to fixing any critical security flaws found on it for the lifetime of that device".

        So, if internet Usage Statistics suggest that only 2 people are still running iPhoneOS 1.0, it must be Maintained?

        Riiight. . .

    • How about we present the message: recycle old devices that cannot be updated anymore?

      Apple does not back port all fixes. They only fully update their latest OS.

      Their usual Policy is to fully Maintain the Current Major OS Version and the Previous Major OS Version. At present, that means 26.x and 18.x.

      If an Exploit is serious enough, they can and will reach back even further to update even more previous OS Versions.

  • Er (Score:5, Insightful)

    by cascadingstylesheet ( 140919 ) on Thursday March 19, 2026 @07:11AM (#66049326) Journal

    and then disappear without leaving obvious traces.

    Er, do attackers normally leave a handy log of traces?

    and don't assume mobile devices are somehow safer than desktops anymore

    Was ... somebody assuming that? Why?

    • by gweihir ( 88907 )

      Yes, I was wondering the samer things. Quality "journalism" brought to you by a "technology journalist".

      • That appears to be a problem with the summary - the original articles (I must admit I did not read all of the first one) seem to be written by people who have a better idea of what they are talking about.

    • and don't assume mobile devices are somehow safer than desktops anymore

      Was ... somebody assuming that? Why?

      Well, my manager at a Fortune 500 company about 8 years ago assumed/believed that. He was a good manager and had real IT experience. He wasn't a paper pusher who got into IT management. I was floored when he told me he believed accessing stuff via an iPhone was much safer than using a PC. I told him my assumption was the exact opposite. I asked him why he believed that and he said he just assumed various app makers simply had to make their apps more secure because people were moving away from using

      • by Anonymous Coward

        Of course you don't agree with him. That's a foolish stance for him to take. Smart phones are just small computers with radio equipment. I don't want to speculate on who's network, the ISP or Mobile Carrier, is more unsafe, but at least with a desktop, there stands a good chance you are behind at least one firewall and at least one router before you end up on the ISP's network. Do our cellphones even HAVE firewalls on them? Maybe Pine phone does.

        Apps on a phone are no different then apps on a desktop. They

      • This is like people who rationalise that there's Military Grade Encryption that is somehow different to the stuff everyone else uses

        It's kind of a confession about how they see the world, they assume that some corporate commercial retail daddy is making all the necessary work happen out of sight and you should not worry your little head about it. They don't see this as part of the problem, that they're perpetuating a series of adages that prevent the wealthy from being held to account, they explicitly see i

    • by clovis ( 4684 )

      Persistent malware by definition leaves code on the target so it can reload after a reboot.
      What they call memory resident doesn't leave code on the device and therefore doesn't persist across reboots.

    • Re:Er (Score:5, Informative)

      by UnknowingFool ( 672806 ) on Thursday March 19, 2026 @10:57AM (#66049682)

      Er, do attackers normally leave a handy log of traces?

      They do not purposefully leave traces; but breaches can leave traces. Your assumption was traces were left on purpose which is not the normal case.

      Was ... somebody assuming that? Why?

      Applications are more curated on phones than on desktops. Phones are by nature more locked down including use of security chips like iPhone's Secure Enclave, Google's Titan M2, and Samsung's Knox Vault . Desktops have been more open which is why people use them. One of the main reasons Windows 11 cannot be used on some older hardware is that the hardware lacks any ability to add a security chip. Yes some hardware was arbitrarily left off the compatibility list but the push for more security is a main reason some hardware was left behind.

      • My desktop doesn't move around with me, and it's relatively difficult to access the microphone and camera without me knowing about it. PCs generally require a stronger skillset rather than being designed so anyone can use it without understanding the implications. Facebook and other social networks are sandboxed websites on PCs.

        Over all, PCs are less of an attack surface and as a result developers do not, these days, target PCs for information collection. It's not that they're inherently more secure, it's a

      • ... but the push for more security is a main reason some hardware was left behind.

        You should be asking yourself exactly WHOSE security are they interested in because I can guarantee you that it is not YOUR security they care about.

        Does the change provide a basis for more security? Sure. Will the typical user see ANY benefits from it? No.

        • You should be asking yourself exactly WHOSE security are they interested in because I can guarantee you that it is not YOUR security they care about.

          And you should read information about hardware security works like how Apple's Secure Enclave works. [apple.com]

          Does the change provide a basis for more security? Sure. Will the typical user see ANY benefits from it? No.

          Yes. And yes. One thing a TPM does for a machine is a centralized and safe place to store cryptographic algorithms and the keys themselves. However, Microsoft's implementation is extremely lacking compared to Apple's Secure Enclave.

    • by sims 2 ( 994794 )

      Even if they left a 479 page manifesto and a step by step log of everything they did you probably wouldn't be able to access whatever folder it was in without jailbreaking the device.

    • and then disappear without leaving obvious traces.

      Er, do attackers normally leave a handy log of traces?

      Plenty of attacks can leave a trace that they occurred. Why are you under the impression that that's not normal? It's not like attackers ever intentionally left traces of their presence.

      and don't assume mobile devices are somehow safer than desktops anymore

      Was ... somebody assuming that? Why?

      Have you never interacted with a member of the general public? Or seen how they use their devices? People tend to not think of their phones as being phones, not as computers. With computers, the extent of their security awareness is knowing that computers can get infected with viruses, but

    • > The takeaway is simple but important, update your iPhone ASAP and don't assume mobile devices are somehow safer than desktops anymore

      Yeah I wanted to comment on that. They're confusing "Unauthorized third parties stealing your data" as being the only test of whether a system is safer. They ignore that most of us want Google, Apple, and Facebook to be just as unable to profile us as the guys wanting to steal credit cards.

    • Er, do attackers normally leave a handy log of traces?

      Yes. Yes they do. The attackers are lazy and uncaring as long as they get what they want, so lots of clues are left behind because "who cares, I already have mine". The people stealing from you are not very bright.

      and don't assume mobile devices are somehow safer than desktops anymore

      Was ... somebody assuming that? Why?

      Many ignorant people thought that phones would be safer since they are more limited. The limitations were sold as being for the consumer's safety... however, those limitations were actually for the manufacturers safety, not the consumers, but people were sold a load of shit claiming that they were

  • by gweihir ( 88907 ) on Thursday March 19, 2026 @07:15AM (#66049330)

    That sounds to me like a childish belief. What mobile devices get you is a second computer that is not easily associated with your first one for an attacker (if you are careful). But they are just computers. Not special in any way except for the from-factor.

    I guess too many people still see tech as "magic".

    • by pjt33 ( 739471 )

      I assume my phone is less secure than my desktop, because it's less frequently updated and probably a preferential target.

      • I assume my phone is less secure than my desktop, because it's less frequently updated and probably a preferential target.

        And fscking impossible to firewall properly. I've never tried with an apple phone but an android phone with always on VPN will still bypass the VPN when it feels like because "the OS is too important to be inconvenienced by such things"

        The easiest way to see this happening is to remove the sim, so it has no mobile data at all, connect to wifi and turn on always on VPN.

        Then monitor for tr

    • by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Thursday March 19, 2026 @07:34AM (#66049346) Homepage Journal

      Who thinks mobile devices are secure? That sounds to me like a childish belief. [...] I guess too many people still see tech as "magic".

      Banks think mobile devices are secure. That's why they will let you upload a check image from your bank app but not from your desktop where you scanned it at high enough resolution to see security features.

      • by gweihir ( 88907 )

        Banks think mobile devices are secure. That's why they will let you upload a check image from your bank app but not from your desktop where you scanned it at high enough resolution to see security features.

        From the use of the historic concept of a "Cheque" (I assume auto-correct made that into "check") I assume you are talking about US banks? For some European banks I know, they assume a large faction of phones are compromised. They do assume the compromise is more limited on a phone and they scan for malware (as much as a single app is allowed to), but basically they just use the phone as 2nd factor where an attacker would have to compromise both devices to really gain anything. But they carefully monitor th

        • From the use of the historic concept of a "Cheque" (I assume auto-correct made that into "check")

          No, that's how we spell it in American English, the language spoken where this site was created and is hosted.

          I assume you are talking about US banks?

          That part is correct.

          For some European banks I know, they assume a large faction of phones are compromised. They do assume the compromise is more limited on a phone

          Womp womp

          • by AmiMoJo ( 196126 )

            While cheque is the standard in British English, the original spelling was check, and the Oxford Dictionary still recognizes that.

            Personally I prefer Oxford spelling, e.g. "recognize". It has the added benefit of not instantly identifying me as British online.

            • I personally don't care which people use, I can read either one just fine without confusion. I just don't want to be told that I'm using the wrong word or whatever when that's clearly not so.

        • I believe they are called Czechs. At least now that the republic doesn't also include Slovakia.
      • Who thinks mobile devices are secure? That sounds to me like a childish belief. [...] I guess too many people still see tech as "magic".

        Banks think mobile devices are secure. That's why they will let you upload a check image from your bank app but not from your desktop where you scanned it at high enough resolution to see security features.

        The real reason? Banks hold ZERO liability regarding your personal device. Has almost nothing to do with security.

        If they were actually liable, they would make you walk into a bank to deposit a check. Where they would check an approved form of ID in person, and perform additional analysis on the check itself to ensure it was valid. A process approved in triplicate by their liability mitigation department.

        Right now banks can't even handle a small bank run. In the end, I doubt even that fancy FDIC placa

      • by Jaime2 ( 824950 )

        Banks think mobile devices are secure.

        Are you inferring that since they let you use a mobile device that they think they're secure?

        This is the same group of organizations that will allow you to withdraw cash if you know a four digit code that hasn't been changed in the account holder's entire lifetime. The same group of organizations that will allow you to ACH transfer funds from an account because you know the account number and routing number, which are both on every check they hand out.

        BTW, none of the things in the previous paragraph are en

    • by Anonymous Coward

      I guess too many people still see tech as "magic".

      No. Most people (including IT) more see that device as far more locked down. Go figure the overwhelming majority of people feel that way when root or admin rights an iPhone hasn't been reduced to a right-click option or pop-up approval for just any fucking moron user to click on.

      Why do you think they've lasted this long in the corporate world? Side-loading hacker-friendly OSes were NOT going to make Crackberry execs feel secure.

    • by havana9 ( 101033 )
      They aren't general purpose personal computer, but somewhat specialized devices. The software one could install on a smartphone has normally a standard installation from a store and it's suppose that it's more curated than the average downloaded package. In other terms because a smartphone it's more limited, there are lesser ways to compromise it compared to a PC, especially if both are used by not tech savvy people.
      • by AmiMoJo ( 196126 )

        The main reason banks trust phones more is because Android and iOS both have decent mechanisms for detecting when apps and the OS have been altered. The reason your banking app takes so long to start up is because the OS is verifying that both the OS itself and the app are functioning as intended.

        If you root your Android device you will find that many such apps refuse to work.

    • Mobile devices are just computer, but in addition have so many additional attack surfaces plus arbitrary enforced obsolescence on software can really make it worse than a general purpose computer. The browser really should be easily upgradeable in perpetuity and not locked to an OS version. It's irresponsible planned obsolescence of devices that causes this.

    • I'd wager that 90% of the planet thinks so. Only tinfoil-hat-wearing Slashdorks don't see their phones as perfectly secure.

  • Nota Bene (Score:5, Insightful)

    by Artem S. Tashkinov ( 764309 ) on Thursday March 19, 2026 @09:38AM (#66049544) Homepage

    don't assume mobile devices are somehow safer than desktops anymore

    Both iOS and Android are full-fledged operating systems, and the only reason they are considered safer than desktop operating systems is because their application stores are somewhat curated. That's it.

    Their software stacks are very similar to desktop operating systems, except they both strip you of superuser rights by default. That doesn't mean their kernels and user space are significantly more secure; they're just a tad different.

    Not updating either of them is like leaving your house key out in the open.

    • There's more to it than just 'smaller'. Cellphone OS are designed to provide a smaller attack surfaces. They provide less access (iOS provides no conventional user-visible file system) in exchange for that security.

      But consider: Here an iOS vulnerability makes headlines. A new Windows vulnerability is just "meh".

      I find it interesting that some here would want operating system vendors to be legally liable for security vulnerabilities? Will they also accept legal liability for bugs in their own applicati

    • Both iOS and Android are full-fledged operating systems, and the only reason they are considered safer than desktop operating systems is because their application stores are somewhat curated. That's it.

      Smartphones and their OSes use security chips whereas desktops are only now implementing those features. One of the pain points of Windows 11 upgrades was the TPM requirement.

    • I'm pretty sure banks, in particular like phones or devices with verified registered users. Social media are same. Devices are basically people.
  • This is one problem with locking down the OS. With enough motivation, hackers are able to find ways to get around the security to access the deep system layers. However, users and legitimate apps are locked out and must rely on the OS provided APIs and tools.

    This creates an imbalance in the security of the OS. A power user can't launch a root terminal and just take a look at what's going on. They are bound by the OS level sandbox, and can only access so much of the system. Which also means that any user le

All science is either physics or stamp collecting. -- Ernest Rutherford

Working...