Apple has shipped a round of security updates tackling two iMessage group-chat privacy flaws — including one that would let a remote attacker slip into a conversation and begin receiving its messages — alongside fixes for separate Bluetooth pairing vulnerabilities, according to The Hacker News.
The more serious of the two issues allowed someone who was not a member of a group chat to enter it remotely and pull down the messages exchanged there, The Hacker News said in its 14 November report. The second flaw sat on the other side of the same boundary: a person legitimately added to a group could read messages sent before they joined, defeating the expectation that arriving in a conversation does not hand you its past.
Apple released the fixes at the same time as it disclosed the issues.
Encryption was not the weak point
Neither flaw is a story about cryptography. Both are authorisation failures — questions of who is allowed to be in a conversation, and what a newcomer gets to see once they are. An attacker who lands inside a group legitimately reads its messages exactly as any other member would, with no break in the encryption required.
That gap matters when IT teams assess messaging security. End-to-end encryption guards content in transit; it says nothing about membership checks, invitation handling, or the backfill behaviour triggered when someone joins a thread. A protocol can be sound on paper while the access control wrapped around it quietly is not. For anyone signing off on messaging tools for sensitive group work, the two properties warrant separate scrutiny.
Device coverage
As of the day after release, the updates were available for the iPhone XS, iPhone XS Max and iPhone XR, the seventh-generation iPad, and a number of other Apple devices, The Hacker News reported. Fixes for the Bluetooth pairing weaknesses arrived in the same advisory cycle, though the specific nature of those pairing flaws was not spelled out in the disclosure as reported.
What to do
Apply the update on every iPhone and iPad that offers it, through the standard software update path in Settings. Devices that have fallen out of update support cannot be patched at all, and their owners should factor that in when choosing hardware for sensitive conversations.
Because the fix arrives as an OS update rather than an app-level change, confirm that both managed and personally owned (BYOD) devices have actually picked it up. Mobile device management policies, deferred update schedules and user postponement can leave machines on vulnerable builds for days or weeks after a patch ships — a real exposure window in mixed-fleet environments.
For Bluetooth, the update addresses the underlying flaws. Good pairing-record hygiene — clearing stale pairings and limiting discoverability in public settings — remains sensible alongside it.
Full details, including the complete device coverage, are in The Hacker News report published on 14 November.
據 The Hacker News 報道，Apple 已推出一輪安全更新，處理兩個 iMessage 群組對話私隱漏洞——其中包括一個可讓遠端攻擊者混入對話並開始接收其訊息的漏洞——同時亦修補了數個 Bluetooth 配對相關的漏洞。
The Hacker News 於 11 月 14 日的報道指出，兩個問題中較為嚴重的一個，容許並非群組對話成員的人遠端進入群組，下載其中交換的訊息。第二個漏洞則出現在同一條界線的另一端：一個被正當加入群組的人，可以讀取其加入之前已發出的訊息，打破了「加入對話並不等於獲得其過去內容」的預期。
Apple 在披露有關問題的同時發布了修補程式。
加密並非薄弱環節
兩個漏洞都與密碼學（cryptography）無關。兩者本質上都是授權（authorisation）失效——問題在於誰獲准置身對話之中，以及新加入者一旦進入後可以看到什麼。攻擊者一旦正當進入群組，其讀取訊息的方式與任何其他成員完全相同，無須破解加密。
這個漏洞對 IT 團隊評估通訊軟件安全時至關重要。端對端加密（end-to-end encryption）保護的是傳輸中的內容；至於成員資格核實、邀請處理，或有人加入 thread 時觸發的歷史訊息回填（backfill）行為，加密機制則無從保障。一套協議可以在紙面上無懈可擊，但包裹其外的存取控制（access control）卻可能悄然失效。對於任何需要為涉敏感群組工作審批通訊工具的人而言，這兩項特性必須分開審視。
裝置覆蓋範圍
The Hacker News 報道稱，截至發布翌日，更新已適用於 iPhone XS、iPhone XS Max、iPhone XR、第七代 iPad 以及其他多款 Apple 裝置。Bluetooth 配對弱點的修補程式在同一輪公告中發布，不過據報道，披露文件並未詳細說明那些配對漏洞的具體性質。
應如何處理
每一部提供此更新的 iPhone 和 iPad 都應透過「設定」中的標準軟件更新途徑安裝更新。已停止更新支援的裝置完全無法修補，其用家在為敏感對話選擇硬件時應將此因素考慮在內。
由於修補程式是以 OS 更新而非應用程式層面改動的形式推出，應確認受管理裝置及個人自帶裝置（BYOD）均已實際套用更新。流動裝置管理（MDM）政策、延遲更新排程以及用戶手動推遲，都可能令設備在補丁發布後數日甚至數星期仍停留在有漏洞的版本上——在混合裝置環境中，這是一個真實的暴露風險窗口。
就 Bluetooth 而言，更新已修補底層漏洞。配對紀錄管理的良好習慣——清除過時的配對紀錄、在公眾場合限制可被發現性——仍然值得配合實施。
完整的詳細資料，包括完整的裝置覆蓋範圍，可參閱 The Hacker News 於 11 月 14 日發表的報道。