Security News > 2024 > July > 'Almost every Apple device' vulnerable to CocoaPods supply chain attack
EVA claims CocoaPods in 2014 migrated all "Pods" - a file describing a project's dependencies - to a new "Trunk server" on GitHub.
CocoaPods authenticates new devices using an email sent to users who request a session, the researchers noted - but authentication doesn't rely on anything but a client verifying their email address by clicking a link.
"We have found that almost every Pod owner is registered with their organizational email on the Trunk server, which makes them vulnerable to our zero-click takeover vulnerability," warned the EVA team.
The researchers noted that they actually used the method "To take over the owner accounts of some of the most popular CocoaPods packages," which "We could have used for highly damaging supply chain attacks that could impact the entire Apple ecosystem."
CocoaPods maintainers contacted by The Register didn't respond to questions before publication.
The researchers recommend everyone using CocoaPods review their dependencies for orphaned Pods, perform checksum validations on all code downloaded from the CocoaPods Trunk server, review all third-party code, update their CocoaPods installations and generally be more attentive to open source software supply chain risks.
News URL
Related news
- Recent GitHub supply chain attack traced to leaked SpotBugs token (source)
- SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack (source)
- That massive GitHub supply chain attack? It all started with a stolen SpotBugs token (source)
- Apple fixes two zero-days exploited in targeted iPhone attacks (source)
- Apple Patches Two Actively Exploited iOS Flaws Used in Sophisticated Targeted Attacks (source)
- Apple plugs zero-day holes used in targeted iPhone attacks (CVE-2025-31200, CVE-2025-31201) (source)
- Apple Patches Two Zero-Days Used in ‘Extremely Sophisticated’ Attacks (source)
- Ripple's xrpl.js npm Package Backdoored to Steal Private Keys in Major Supply Chain Attack (source)
- Ripple NPM supply chain attack hunts for private keys (source)
- Apple 'AirBorne' flaws can lead to zero-click AirPlay RCE attacks (source)