A deep dive into iOS Exploit chains found in the wild • Hacker News Board

Re: A deep dive into iOS Exploit chains found in the wild

#31

Post by thenewnewguy » Fri, Aug 30, 2019, 4:17 AM UTC

maxdamantus wrote: post #27

jijji wrote: post #24

Earlier quoted context omitted.

maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.

I find this hard to believe given that security isn't about "having security", but about "not having buggy software". Unless you're a power user, you're probably mostly just using web applications at this point, so your main target points are the OS and the web browser. Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm in…

> Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm install" instills a lot of trust on the NPM repository and any packages involved). All of these things increase the attack surface.

This is a fallacy. Rather than assessing the security of the linux kernel or linux distributions you're making taking an assumption about linux users and transferring the blame for their insecure practices onto linux itself.

Think of it this way: If a random Windows user that didn't engage in such behavior was to switch to linux it's unlikely that would suddenly change. If the linux kernel and system programs are more secure than windows that make linux a good choice if that person cares about security.

Note: I'm not making a statement about the security of linux/windows, just pointing out a flaw in the above argument.

Re: A deep dive into iOS Exploit chains found in the wild

#32

Post by pjlnotsecure » Fri, Aug 30, 2019, 4:18 AM UTC

arkadiyt wrote: post #29

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why? edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code wa…

It leaves me in awe how good some hackers are, until it comes to hardening a Linux Server. The difference is astounding. Not knowing how to setup SSL on Apache, not knowing how to enable UFW (lol it’s “sudo ufw enable”), etc. Never was sure why that dichotomy was there. Then again I’m a terrible pentester but am very good at Linux.

Re: A deep dive into iOS Exploit chains found in the wild

#33

Post by jijji » Fri, Aug 30, 2019, 4:30 AM UTC

maxdamantus wrote: post #27

jijji wrote: post #24

Earlier quoted context omitted.

maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.

I find this hard to believe given that security isn't about "having security", but about "not having buggy software". Unless you're a power user, you're probably mostly just using web applications at this point, so your main target points are the OS and the web browser. Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm in…

The argument from the parent about using a laptop is "orders of magnitude" less safe than using a iOS or android device is just not true. It depends what you're running on each device.

Re: A deep dive into iOS Exploit chains found in the wild

#34

Post by maxdamantus » Fri, Aug 30, 2019, 4:35 AM UTC

thenewnewguy wrote: post #31

maxdamantus wrote: post #27

Earlier quoted context omitted.

I find this hard to believe given that security isn't about "having security", but about "not having buggy software". Unless you're a power user, you're probably mostly just using web applications at this point, so your main target points are the OS and the web browser. Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm in…

> Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm install" instills a lot of trust on the NPM repository and any packages involved). All of these things increase the attack surface. This is a fallacy. Rather than assessing the security of the linux kernel or linux distributions you're making taking an assumption about l…

> Rather than assessing the security of the linux kernel or linux distributions you're making taking an assumption about linux users

I was responding to that assumption made by the parent:

> people who run laptops using linux probably have more security in the laptop than on their phone

Re: A deep dive into iOS Exploit chains found in the wild

#35

Post by js2 » Fri, Aug 30, 2019, 4:39 AM UTC

dontbenebby wrote: post #23

js2 wrote: post #12

This is terrifying. Just thinking about the data on a typical phone... the Implant could easily grab everything it needs to empty all of your financial accounts. The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted. Ouch.

>The only way to be safe is probably to access your financial sites These folks don't want money. And statue protects you from fraud - just set up text and email alerts so large transactions alert you ASAP.

Except they have control of the phone and can intercept text and email alerts, if not with these exact vulnerabilities, it doesn't seem far fetched. And getting funds returned takes time while bills still have to be paid.

These folks may not want money, but the phone is vulnerable and the next set of folks may. Do you really think the crooks who commit identity theft and ransomware attacks aren't salivating at these attacks?

Re: A deep dive into iOS Exploit chains found in the wild

#36

Post by maxdamantus » Fri, Aug 30, 2019, 4:41 AM UTC

jijji wrote: post #33

maxdamantus wrote: post #27

Earlier quoted context omitted.

I find this hard to believe given that security isn't about "having security", but about "not having buggy software". Unless you're a power user, you're probably mostly just using web applications at this point, so your main target points are the OS and the web browser. Someone "using Linux" is likely to be running various things such as SSH/HTTP/file servers, native IRC clients, random build systems (running "npm in…

The argument from the parent about using a laptop is "orders of magnitude" less safe than using a iOS or android device is just not true. It depends what you're running on each device.

When you run any given application on your laptop, it's normally run in such a way that it has all of your user's priveleges on the system; that is, it can access all files that you can access, it can look at the screen that you're looking at, it can produce any input that you can produce, it can manipulate the memory of any process that you can manipulate.

When you run an application on iOS or Android, it doesn't have those capabilities. It can only get them through security exploits. In theory it should be similar to looking at a web page. If a web page is able to read arbitrary files, that's obviously a bug in the system. If an application on your laptop is able to read arbitrary files, that's standard functionality.

Re: A deep dive into iOS Exploit chains found in the wild

#37

Post by pjmlp » Fri, Aug 30, 2019, 4:41 AM UTC

jijji wrote: post #24

ikeboy wrote: post #18

Earlier quoted context omitted.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

maybe in a windows laptop, but people who run laptops using linux probably have more security in the laptop than on their phone, most browsers are pretty safe.

Depends pretty much on what they are actually running.

https://www.cvedetails.com/vendor/33/Linux.html

Re: A deep dive into iOS Exploit chains found in the wild

#38

Post by js2 » Fri, Aug 30, 2019, 4:54 AM UTC

pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

> Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. The hacked sites were being used in indiscriminate watering hole attacks against their visitors, using iPhone 0-day.

Crazy that the Implant was never detected directly on a phone. It's certainly visible to iOS itself, but apparently iOS isn't looking for unexpected processes running on the phone. As well, the Implant is sending network traffic that no one ever noticed or never tracked down. And presumably it has some affect on battery life. But all of this just disappears into the noise of everything else going on on an iPhone.

I wonder if the Implant ever showed up in any of the crash reports collected by iOS and uploaded to Apple.

Re: A deep dive into iOS Exploit chains found in the wild

#39

Post by jen_h » Fri, Aug 30, 2019, 4:58 AM UTC

ds wrote: post #5

radicaldreamer wrote: post #2

This is terrifying... most people do not hard reset their phones ever (even when upgrading). What are the odds that these payloads are floating around despite the exploits being patched?

From the article, a reboot will do it. You dont need a hard reset : "The implant binary does not persist on the device; if the phone is rebooted then the implant will not run until the device is re-exploited when the user visits a compromised site again. "

The implant is gone, but the attacker still has keychain data and can/did/does use it to continue downloading data in clear text:

“The implant uploads the device's keychain, which contains a huge number of credentials and certificates used on and by the device. ... The keychain also contains the long-lived tokens used by services such as Google's iOS Single-Sign-On to enable Google apps to access the user's account. These will be uploaded to the attackers and can then be used to maintain access to the user's Google account, even once the implant is no longer running. ... There's something thus far which is conspicuous only by its absence: is any of this encrypted? The short answer is no: they really do POST everything via HTTP (not HTTPS) and there is no asymmetric (or even symmetric) encryption applied to the data which is uploaded. Everything is in the clear.”

(Source: https://googleprojectzero.blogspot.com/2019/08/implant-teard...)

Re: A deep dive into iOS Exploit chains found in the wild

#40

Post by jen_h » Fri, Aug 30, 2019, 5:00 AM UTC

arkadiyt wrote: post #29

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why? edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code wa…

They own all the pipes, why bother hiding what passes through them?