Apple Closes iPhone Vulnerability Allegedly Used by FBI to Read Messages
Apple has released an iOS 16.4.2 update to close a security vulnerability that was allegedly exploited by law enforcement agencies, including the Federal Bureau of Investigation (FBI), to access iPhone users’ messages.
The flaw relates to the iPhone’s notification system, which continues to store copies of messages even after the sending application has been deleted.
In several cases, messages from apps like Signal could still be retrieved from the device’s notification database.
Technically, the issue arises because iOS retains notification data within the system, including the content of messages that should have been deleted.
However, users generally assume that deleting an app will also remove all associated data.
In previously revealed cases, authorities were able to extract messages from encrypted apps like Signal through this mechanism, even if the app was no longer on the device.
Apple states that it has fixed the issue via the iOS 16.4.2 update, as reported by KompasTekno from Apple Insider.
The fix targets the logging and storage of notifications to ensure that data that should be deleted is no longer stored on the device.
With this repair, deleted notifications now leave no trace in the internal system.
This vulnerability has raised concerns about privacy, particularly for users of encrypted messaging apps who rely on end-to-end security systems. Although messages in the app remain encrypted, copies of message content appearing in notifications could become a weak point if stored in the system.
Apple has not directly linked this update to any specific case, but its release timing coincides with the revelation of data access methods by authorities.
iOS 16.4.2 brings no new features for users, instead focusing on bug fixes and system security improvements.
The update was released alongside iPadOS 16.4.2 and updates for older devices, as part of Apple’s efforts to close security gaps across devices.
With this update available, iPhone users are advised to install it immediately to ensure their personal data remains protected from potential unauthorised access.