Security News > 2024 > July > Millions of Apple Applications Were Vulnerable to CocoaPods Supply Chain Attack
The security team says they found vulnerable CocoaPods pods in "The documentation or terms of service documents of applications provided by Meta, Apple, and Microsoft; as well as in TikTok, Snapchat, Amazon, LinkedIn, Netflix, Okta, Yahoo, Zynga, and many more."
E.V.A. reported the vulnerability to CocoaPods in October 2023, at which point it was patched.
"The CocoaPods team responded responsibly and swiftly to the vulnerabilities once disclosed," E.V.A. Information Security wrote.
Must-read Apple coverage Vulnerabilities originated in CocoaPods.
The CocoaPods vulnerabilities are a good reminder to developers and DevOps teams not to forget about dependency managers, which could be a potential weak link in supply chain security.
To handle the CocoaPods vulnerabilities, developers and DevOps teams should double check the open-source dependencies used in their application code.
News URL
https://www.techrepublic.com/article/apple-applications-cocoapods-supply-chain-attack/
Related news
- China-Linked Silk Typhoon Expands Cyber Attacks to IT Supply Chains for Initial Access (source)
- Apple fixes WebKit zero-day exploited in ‘extremely sophisticated’ attacks (source)
- Apple Releases Patch for WebKit Zero-Day Vulnerability Exploited in Targeted Attacks (source)
- GitHub supply chain attack spills secrets from 23,000 projects (source)
- Supply chain attack on popular GitHub Action exposes CI/CD secrets (source)
- Google acquisition target Wiz links fresh supply chain attack to 23K pwned GitHub repos (source)
- GitHub Action hack likely led to another in cascading supply chain attack (source)
- GitHub Action supply chain attack exposed secrets in 218 repos (source)
- Coinbase Initially Targeted in GitHub Actions Supply Chain Attack; 218 Repositories' CI/CD Secrets Exposed (source)
- ⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More (source)