A deep dive into iOS Exploit chains found in the wild
googleprojectzero.blogspot.com
A deep dive into iOS Exploit chains found in the wild
1–10 of 202 posts
Re: A deep dive into iOS Exploit chains found in the wild
#2This is terrifying... most people do not hard reset their phones ever (even when upgrading). What are the odds that these payloads are floating around despite the exploits being patched?
Re: A deep dive into iOS Exploit chains found in the wild
#3Anyone know what kinds of sites were hacked to target iOS visitors to the sites, and who might have been targeted by these attacks? The blog post hints at the targeting of dissidents, but I'm not sure whether that is a general concern or actually there in these hacks.
Re: A deep dive into iOS Exploit chains found in the wild
#4[deleted]
Re: A deep dive into iOS Exploit chains found in the wild
#5This is terrifying... most people do not hard reset their phones ever (even when upgrading). What are the odds that these payloads are floating around despite the exploits being patched?
From the article, a reboot will do it. You dont need a hard reset :
"The implant binary does not persist on the device; if the phone is rebooted then the implant will not run until the device is re-exploited when the user visits a compromised site again. "
Re: A deep dive into iOS Exploit chains found in the wild
#6These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were.
Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint.
The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by overly widening their intended targets. What I mean by this is: they clearly could have chosen to gain a massive infection rate by combining this with hacking a well-known popular site, or even pulling more visits from (say) social media, but instead the malicious actor chose to limit their intended recipients to run the exploits for a smaller set of targets for much longer while remaining undetected.
This, to me, hints at a state-actor with specific intent.
Re: A deep dive into iOS Exploit chains found in the wild
#7It's staggering how systematically broken IOKit remains.
Re: A deep dive into iOS Exploit chains found in the wild
#8Time for widespread adoption of mobile EDR.
Re: A deep dive into iOS Exploit chains found in the wild
#9These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…
If you are under constant attack from well funded enemies who want to destroy you, attacking iOS with well focused exploits is a good way of getting intelligence. The enemy may be lulled into a false sense of security on iOS and if the exploit goes undiscovered for a long time, a lot of intelligence can be obtained.
Re: A deep dive into iOS Exploit chains found in the wild
#10It's staggering how systematically broken IOKit remains.
Technically these are bugs in IOKit drivers and not the IOKit framework itself: it’s a footgun and not an exploding gun.