4-year campaign backdoored iPhones using possibly the most advanced exploit ever

return2ozma@lemmy.world to Technology@lemmy.world – 526 points –
4-year campaign backdoored iPhones using possibly the most advanced exploit ever
arstechnica.com
56

You are viewing a single comment

Wow, this is a very complex exploit, involving bits of iMessage and an undocumented CPU feature that allowed the attacker to evade hardware memory protection. From what I can see, Lockdown mode would have prevented this. The attacker is ridiculously skilled regardless

Exerpts from the article missing from the bot summary:

The mass backdooring campaign, which according to Russian officials also infected the iPhones of thousands of people working inside diplomatic missions and embassies in Russia, according to Russian government officials, came to light in June. Over a span of at least four years, Kaspersky said, the infections were delivered in iMessage texts that installed malware through a complex exploit chain without requiring the receiver to take any action.

With that, the devices were infected with full-featured spyware that, among other things, transmitted microphone recordings, photos, geolocation, and other sensitive data to attacker-controlled servers. Although infections didn’t survive a reboot, the unknown attackers kept their campaign alive simply by sending devices a new malicious iMessage text shortly after devices were restarted.

The most intriguing new detail is the targeting of the [...] hardware feature [...]. A zero-day in the feature allowed the attackers to bypass advanced hardware-based memory protections designed to safeguard device system integrity even after an attacker gained the ability to tamper with memory of the underlying kernel.

someone was made fun of one too many times about having green bubbles in imessage

Seems like the definition of advanced persistent threat.

It isn't persistent over a reboot, but the tested devices received new corrupted iMessages immediately after reboot

Persistent in APT isn't referring to the malware itself, but rather the threat actor. I meant that this seems like a textbook APT actor.

You know what else was also super sophisticated, chained, and confident enough in it's APT to not be persistent across reboots? DOUBLEPULSAR.

With that many exploits being used I wouldn't be surprised to see it is a group probably government sponsored. They love iMessage exploits as original attack vectors too.

Russian authorities say it was the Americans trying to spy on other NATO nations, Israel, and Ukraine. America spying on Russia's enemies.

Well, I may be under the wrong impression but it occurred to me that the US govt likes to spy on everyone, friends and foes and the US citizens, too

Edit: punctuation

Documentary about the pheonix software explains a lot about who used this kind of virus, mainly political figures and govermants to spy on other politicans and jornalists. The imessage exploit was known for a few years but nobody knew how the file installed itself on the device, so there was no way to figure out how to protect the device.