A deep dive into iOS Exploit chains found in the wild

Post by toxik » Fri, Aug 30, 2019, 8:36 AM UTC

DavideNL wrote: post #57

pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

Post by anon9001 » Fri, Aug 30, 2019, 8:37 AM UTC

js2 wrote: post #38

pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

> Earlier this year Google's Threat Analysis Group (TAG) discovered a small collection of hacked websites. The hacked sites were being used in indiscriminate watering hole attacks against their visitors, using iPhone 0-day. Crazy that the Implant was never detected directly on a phone. It's certainly visible to iOS itself, but apparently iOS isn't looking for unexpected processes running on the phone. As well, the Im…

Post by londons_explore » Fri, Aug 30, 2019, 9:33 AM UTC

pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

Post by londons_explore » Fri, Aug 30, 2019, 9:41 AM UTC

dmix wrote: post #56

lawnchair_larry wrote: post #48

Earlier quoted context omitted.

Because the entity who supplied the exploit has no relation to the entity who supplies the implant and control framework. The latter is commodity developer work, easily done in house or via a defense contractor. It’s not unlikely that the exploit developer had no idea what it was being used in or how.

In my experience infosec people tend to be pretty awful programmers. They are experts at mining other people's code bases for common exploit patterns but not so great at the wider systems/engineering stuff. But agreed it was probably purchased from some vuln dev and put together by some hack gov employee with some Microsoft certifications or (far less likely) some indifferent blackhat with powerful weapons well out o…

Post by londons_explore » Fri, Aug 30, 2019, 9:44 AM UTC