Apple Releases iOS 15.7.1 and iPadOS 15.7.1 to Fix Security Vulnerabilities on Older Devices

There are dozens of you. Dozens.

Still not seeing it complained about much on other forums/boards/etc. I saw one on reddit yesterday.

Give Apple your feedback.

Rest assured, I did that weeks ago. :+1:

1 Like

At least 118 of us, in fact. I started this thread on “Communities” some time back, and the thumbs just keep ticking up …
https://discussions.apple.com/thread/254335452

Fun fact: Apple disappeared censored a post I made on that thread that linked to the original Tidbits thread. Or maybe it’s the sneering way that I used the word “apologia” to describe other comments made on Apple’s “Communities” when describing other supposedly inevitable changes Apple made, like the move from Contacts/Calendars sync from iTunes to iCloud, which you may recall Apple forced everybody into when they initially released 10.9 Mavericks, only to roll it back, when contrasting them to other posts on this issue. Just as then, some of the comments on this question make me a little bit worried for the future of our species. Sigh. One does not wish to be divisive, but one cannot help feeling that some of Apple’s customers are going to defend the indefensible, no matter what, and make it harder for everybody else. iCloud backups are clearly problematic for some people, for a number of reasons, and local backups were a great way for those people, with only a little bit extra inconvenience, to still have backups while keeping them local, with the added benefit that they were very secure and also complete. Now they’re unusable. If there is a reason why they aren’t working now, I hope it’s a very good one, and that Apple intends to bring out a solution that resumes or improves on what we had.

And yes, I sent feedback to Apple, and I hope everyone else affected does too. I’m still astonished that there really isn’t much of a stir coming from elsewhere, but if we can get Apple to see sense on this, I think we should.

1 Like

So, one thing that I thought about is whether this is literally the only way that Apple can stop some sort of attack (by a company like the NSO Group, for example) that somehow allows one of their devices to access a phone that hasn’t yet trusted the device, and forcing a passphrase from the phone prevents this from continuing. I could see Apple not wanting to admit that this is the reason, though I don’t know why they wouldn’t - why they wouldn’t want to warn users on older versions to upgrade. (In other words, NSO Group, or some other company, had some sort of attack against the iPhone that allows their connected device to force a backup without intervention from the device itself, including an initial trust relationship.)

The fact that this was delivered with updates to both iOS 16 and iOS 15 suggests to me that the was intentional and not just an accidental change to something in iOS.

1 Like

I agree that this seems like something Apple would do. Obviously, the full story is only known to Apple, of course, which makes this all very difficult to talk about, but we know a couple of indisputable things. As iMazing explains, the backup encryption is very strong (AES 256 with PBKDF2) rendering it practically secure for all purposes, and Apple added this “fix” after a security researcher reported a vulnerability concerning the way backups were stored on Macs, once they had been streamed from iOS (which is ultimately in control of backup encryption). The discussion thread goes over this in a bit more detail, but I find it … difficult … to credit Apple with adding such a draconian change to iOS, rather than fixing macOS, unless they felt a sudden and irrational sense of duty to its Windows users, and/or it saw a revenue opportunity from iCloud backups being de-facto required (my favourite), or they thought the benefit of local automated backup was outweighed by the possibility of malware backing up phones (possibly unencrypted, possibly encrypted with weak passwords) to locations where attackers could get at them (the reason I think they actually did this). Let’s hope that Apple invents new UI to explicitly allow the user to trigger a backup on demand, preferably without relying on a computer, but in any case giving the user choice to permit automatic backups when they are encrypted, and manual backups with FaceID/TouchID. Otherwise there is realistically no choice for those of us who sync, but to use iCloud.