Apple has released the first security update under its new Rapid Security Response programme, but has sparked confusion after releasing no information about any of the issues it was fixing, while some users have reported that their devices are refusing to accept the update.
Rapid Security Responses are a new type of software release for Apple iPhone, iPad and Mac devices, and are designed to deliver what the tech firm deems to be “important” security improvements in between large-scale software updates.
According to Cupertino, these could be improvements to the Safari web browser, the WebKit framework stack, or other critical system libraries. They can also be used to mitigate some security issues in a more timely fashion, said Apple, such as those that “may have been exploited” – that is to say, zero-day vulnerabilities.
Rapid Security Responses will only ever be delivered for the latest versions of the iOS, iPadOS and macOS operating systems, starting from iOS 16.4.1, iPadOS 16.4.1 and macOS 13.3.1.
Devices should take the updates automatically unless disabled, and those who do take the updates will be able to see that they have been successfully applied as a letter will appear after the software version number – for example, iOS 16.4.1 (a).
Keeping shtum
However, despite an update having gone out to users earlier this week, Apple’s security update page has yet to be updated – at the time of writing, it had not been updated since 12 April.
Similarly, no wider information has been published about any issues affecting Apple devices, although Citizen Lab, the Canadian investigative organisation that exposed the malicious activity of Israeli spyware manufacturer NSO Group and its customers, recently released information revealing that NSO is still developing and exploiting new exploits against Apple devices.
Michael Covington, strategy vice-president at Jamf, said whatever the Rapid Security Response update fixed, the benefits of the new programme far outweighed the lack of clarity.
“These updates contain software fixes to address critical vulnerabilities in the underlying operating system. By restricting these patches to just security fixes, Apple is reducing the amount of code it must develop and test, the time between updates, and the overall size of the patch that each device must download. Overall, this reduces the window of exposure and helps to neutralise exploits that are putting users and organisations at risk,” he said.
“Keeping up-to-date with the latest patches is one of the most effective ways to safeguard devices against cyber threats. Apple’s Rapid Security Response programme makes it simpler and less disruptive for users and administrators to apply necessary updates and ensure that their devices are secure,” he added.
“However, it’s not enough for Apple to provide faster security updates; it’s equally important for the public to understand the significance of applying operating system updates,” continued Covington.
“Shockingly, in 2022, one in five devices ran on an outdated operating system. Therefore, it’s essential for users to be a part of the cyber security strategy and take prompt action when prompted to update their devices.”
At the same time, multiple users of Apple devices complained at first that they could not accept the update.
Among them was Paul Ducklin, principal research scientist at Sophos, who on Monday 1 May wrote that while the update downloaded without issue on an iPhone, he then saw a notification and a popup saying the update failed because he wasn’t connected to the internet, despite being connected to the internet and browsing email at the time.
Staffers at The Verge, a technology magazine, reported the same problem, as did multiple posters on social media sites such as Reddit and Twitter.
At the time of writing, Apple does seem to have successfully fixed this issue, suggesting it was merely a temporary glitch.