Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into iOS Exploit chains found in the wild

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

51–60 of 202 posts

Re: A deep dive into iOS Exploit chains found in the wild

#51

Post by lawnchair_larry »

jen_h wrote: post #19
ummonk wrote: post #3

Anyone know what kinds of sites were hacked to target iOS visitors to the sites, and who might have been targeted by these attacks? The blog post hints at the targeting of dissidents, but I'm not sure whether that is a general concern or actually there in these hacks.

Just a wild and crazy guess here...but if you take this tweet thread: https://twitter.com/adrianzenz/status/1145778611242319874 in context with the following hint: "To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group." ( https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... ) ...and then if you think about what's been going on in Hong Kong recen…

What’s the relation to the first link though? That looks like an old twitter thread.

Re: A deep dive into iOS Exploit chains found in the wild

#52

Post by ryacko »

Analemma_ wrote: post #13

> It is worth noting that none of the exploits bypassed the new, PAC-based JIT hardenings that are enabled on A12 devices. I'm surprised Apple doesn't talk more about how they're continuously upgrading the security of iPhones with new chip generations. I remember the BlackHat presentation on iPhone security from a few years ago [0] also found that there were attacks on older iPhones which didn't work on the (then-)ne…

You don’t need PAC if you disable scripts in Safari. Besides, baseband/browser/iMessage vulnerabilities are in the same price range. [i]

It also isn’t difficult to infer what a “code signing bypass” is, so I guess being arrested is a good excuse to buy a new phone? (Assuming we’re talking about a state based actor, in control of the territory you live in)

i. https://zerodium.com/program.html

Re: A deep dive into iOS Exploit chains found in the wild

#54

Post by mlyle »

bscphil wrote: post #43
ikeboy wrote: post #18

Earlier quoted context omitted.

Switching from an iPhone to a laptop is a huge step down in security, even with 2FA. Orders of magnitude more 0-days on whatever software is running on that laptop than on iOS. This is bad advice.

I disagree. 2FA makes it profoundly more difficult to compromise an account. Most people are using a phone as a second factor, so even if the apps don't store files and credentials directly on the device (always in doubt, as seen here), if you have root on a phone you can compromise an account without any user interaction. What's more, every time you download a banking app on your phone, you have to place a little bi…

> 2FA makes it profoundly more difficult to compromise an account.

Just because the attacks are dumb.

If your computer is pwned, it should wait for you to 2FA, and then when you "log out"-- don't, do malicious stuff instead.

Re: A deep dive into iOS Exploit chains found in the wild

#55

Post by yamrzou »

The list of apps being monitored which are hardcoded directly in the implant[1] include :

    com.yahoo.Aerogram
    com.microsoft.Office.Outlook
    com.netease.mailmaster
    com.rebelvox.voxer-lite
    com.viber
    com.google.Gmail
    ph.telegra.Telegraph
    com.tencent.qqmail
    com.atebits.Tweetie2
    net.whatsapp.WhatsApp
    com.skype.skype
    com.facebook.Facebook
    com.tencent.xin
[1] https://googleprojectzero.blogspot.com/2019/08/implant-teard...

Re: A deep dive into iOS Exploit chains found in the wild

#56

Post by dmix »

lawnchair_larry wrote: post #48
arkadiyt wrote: post #29

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why? edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code wa…

Because the entity who supplied the exploit has no relation to the entity who supplies the implant and control framework. The latter is commodity developer work, easily done in house or via a defense contractor. It’s not unlikely that the exploit developer had no idea what it was being used in or how.

In my experience infosec people tend to be pretty awful programmers. They are experts at mining other people's code bases for common exploit patterns but not so great at the wider systems/engineering stuff.

But agreed it was probably purchased from some vuln dev and put together by some hack gov employee with some Microsoft certifications or (far less likely) some indifferent blackhat with powerful weapons well out of his scope, although 'black market zero day markets' are mostly non-existent hype. Especially for multiple iOS vulns. There's a good reason the cost of those exploits is so high given the low level of programming talent around in security.

Watering holes + "targeting sub-communities" typically mean spies hitting up some conference website or industry news thing. Who knows what country they are in and how sophisticated their local CS people are.

Re: A deep dive into iOS Exploit chains found in the wild

#57

Post by DavideNL »

pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

> leveraged zero-days for iOS for years

Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

Re: A deep dive into iOS Exploit chains found in the wild

#58

Post by janekm »

burnout445 wrote: post #42
dontbenebby wrote: post #23

Earlier quoted context omitted.

>The only way to be safe is probably to access your financial sites These folks don't want money. And statue protects you from fraud - just set up text and email alerts so large transactions alert you ASAP.

I mean that’s generally true but depends on which state actor. North Korea definitely wants your money (or crypto) but Russia doesn’t.

Russia could hypothetically be interested in using your bank account to exfiltrate funds past sanctions though...

Re: A deep dive into iOS Exploit chains found in the wild

#60

Post by zatkin »

yamrzou wrote: post #55

The list of apps being monitored which are hardcoded directly in the implant[1] include : com.yahoo.Aerogram com.microsoft.Office.Outlook com.netease.mailmaster com.rebelvox.voxer-lite com.viber com.google.Gmail ph.telegra.Telegraph com.tencent.qqmail com.atebits.Tweetie2 net.whatsapp.WhatsApp com.skype.skype com.facebook.Facebook com.tencent.xin [1] https://googleprojectzero.blogspot.com/2019/08/implant-teard...

These are all social networking services. Maybe, just maybe, this was tied to the PRISM program led by the NSA?
Post reply on HN