11–20 of 202 posts
Time for widespread adoption of mobile EDR.
Poking a hole in the sandbox for "security" or "auditing" seems a bit risky.
The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted.
Ouch.
I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)newer ones. Is Apple afraid it will give the impression that existing phones are not secure?
> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…
> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…
Anyone know what kinds of sites were hacked to target iOS visitors to the sites, and who might have been targeted by these attacks? The blog post hints at the targeting of dissidents, but I'm not sure whether that is a general concern or actually there in these hacks.
If nothing else, that would be a pretty good guess, given that amateurs don't have the skill to come up with "five separate, complete and unique iPhone exploit chains", and a professional team with the skill to create them is either going to report the vulnerabilities (white hat) or sell them on the black market, or at least try to infect a large number of people. The specificity of putting them on a single website with only "thousands" of views per week suggests that someone wanted to target visitors of that site specifically, not just for financial gain.
This is terrifying. Just thinking about the data on a typical phone... the Implant could easily grab everything it needs to empty all of your financial accounts. The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted. Ouch.
This is terrifying. Just thinking about the data on a typical phone... the Implant could easily grab everything it needs to empty all of your financial accounts. The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted. Ouch.
Well, you don't necessarily have to jump from one to the other. If you currently do financial stuff on your phone, just enabling 2FA and only browsing them on your laptop is already an enormous step up. There are cases where additional precautions are warranted, but there's no reason to let the perfect be the enemy of the good.
Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS.
This is bad advice.
Anyone know what kinds of sites were hacked to target iOS visitors to the sites, and who might have been targeted by these attacks? The blog post hints at the targeting of dissidents, but I'm not sure whether that is a general concern or actually there in these hacks.
"To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group." (https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...)
...and then if you think about what's been going on in Hong Kong recently -- search iPhone and Hong Kong in both languages and you'll find some interesting posts on Twitter that appear not to want folks to know that:
"All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them." (https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...)
...it kind of reveals itself.
> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…