Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into iOS Exploit chains found in the wild

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

81–90 of 202 posts

Re: A deep dive into iOS Exploit chains found in the wild

#81

Post by Wowfunhappy »

bobthedino wrote: post #64
DavideNL wrote: post #57

Earlier quoted context omitted.

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

A step in the right direction: Apple recently announced that next year security researchers will have access to special iPhones: https://www.theverge.com/2019/8/8/20756629/apple-iphone-secu...

I agree this is "a step in the right direction", but if the iPhones are special, would the exploit run on them?

I suppose it depends on how "special" they are—do they run standard iOS with normal Safari and actual apps?

Re: A deep dive into iOS Exploit chains found in the wild

#82

Post by Wowfunhappy »

idoubtit wrote: post #75
londons_explore wrote: post #66

Earlier quoted context omitted.

This is an odd list. Some big messaging apps like Signal and Line are notably missing, while tools like Mail Master and Voxer seem like pretty minor players compared to the rest. Is there a particular region of the world or community where this specific list makes most sense?

I suppose this list must be combined with the following explanation: "To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group."[^1] So the suspects are countries that fight against the autonomy of a region where the population is ethnically different. The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 mil…

> The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 million according to the UN[^2]. The dominant ethnic in China is Han, and Uygurs have been oppressed for decades.

But China doesn't need exploits to spy on their iPhone-using citizens, right? Because Apple has been cooperating with the Chinese government.

Re: A deep dive into iOS Exploit chains found in the wild

#83

Post by Hitton »

js2 wrote: post #12

This is terrifying. Just thinking about the data on a typical phone... the Implant could easily grab everything it needs to empty all of your financial accounts. The only way to be safe is probably to access your financial sites from a browser running inside a VM, maybe even a dedicated laptop, and never sync the passwords to anywhere outside the VM unencrypted. Ouch.

The dedicated laptop would be smarter idea. Running "sensitive" tasks from VM doesn't provide much protection if the host might be compromised.

Re: A deep dive into iOS Exploit chains found in the wild

#84

Post by eitland »

arkadiyt wrote: post #29

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why? edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code wa…

> With this level of sophistication I feel like it can only be intentional, but why?

Hehe, I have an idea, it is kind of crazy so I assign it if I where right it seems to kind of work:

Plausible deniability.

We all "know" that well funded three letter agencies wouldn't let shoddy work like this pass.

As long as you aren't afraid that anyone will capture it in transit this is a good way to avoid suspicion.

Which could explain why it was so overdone, to make sure everybody sees how unlikely it is that a state actor have done it.

Re: A deep dive into iOS Exploit chains found in the wild

#85

Post by someguydave »

londons_explore wrote: post #69

Do you think theres a bank of iPhones at Google loading every webpage on the internet, and looking for unexpected background processes or network traffic?

Either that or they have specialized web-crawlers that emulate various browsers.

Re: A deep dive into iOS Exploit chains found in the wild

#86

Post by jen_h »

lawnchair_larry wrote: post #51
jen_h wrote: post #19

Earlier quoted context omitted.

Just a wild and crazy guess here...but if you take this tweet thread: https://twitter.com/adrianzenz/status/1145778611242319874 in context with the following hint: "To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group." ( https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d... ) ...and then if you think about what's been going on in Hong Kong recen…

What’s the relation to the first link though? That looks like an old twitter thread.

Did you look at the screenshot and read the translation? Appears to be a real-time tracking database of Uighurs...

Re: A deep dive into iOS Exploit chains found in the wild

#87

Post by londons_explore »

someguydave wrote: post #85
londons_explore wrote: post #69

Do you think theres a bank of iPhones at Google loading every webpage on the internet, and looking for unexpected background processes or network traffic?

Either that or they have specialized web-crawlers that emulate various browsers.

Emulating a browser wouldn't be good enough for most exploits. Most stealthy malware immediately deactivates itself if it thinks it is on an emulated or virtualized system.

Re: A deep dive into iOS Exploit chains found in the wild

#88

Post by someguydave »

londons_explore wrote: post #87
someguydave wrote: post #85

Earlier quoted context omitted.

Either that or they have specialized web-crawlers that emulate various browsers.

Emulating a browser wouldn't be good enough for most exploits. Most stealthy malware immediately deactivates itself if it thinks it is on an emulated or virtualized system.

Maybe. The article seems to imply that this implant was given to all comers, which may explain how Google found it.

Re: A deep dive into iOS Exploit chains found in the wild

#89

Post by AnonymousPlanet »

londons_explore wrote: post #70

It seems the webkit renderer process goes into an infinite sleep when this exploit is used. Since iOS doesn't use a seperate renderer for different web domains/iframes, that would mean the entire tab will freeze. Surely that would be a pretty big giveaway for the user - "I was just browsing round the bombmaking-for-dummies webpage, and my browser just froze, and I had to kill it and reopen it".

Safari on iOS is pretty much the most unstable browser I have been using in the last ~5 years. I can't count how many times I had to kill and repopen Safari just because it froze on some Youtube video.

So, no this is not a big giveaway.

Unless something on the Youtube site targeted my own and most of my friends' iOS devices, of course.

Re: A deep dive into iOS Exploit chains found in the wild

#90

Post by snazz »

Wowfunhappy wrote: post #81
bobthedino wrote: post #64

Earlier quoted context omitted.

A step in the right direction: Apple recently announced that next year security researchers will have access to special iPhones: https://www.theverge.com/2019/8/8/20756629/apple-iphone-secu...

I agree this is "a step in the right direction", but if the iPhones are special, would the exploit run on them? I suppose it depends on how "special" they are—do they run standard iOS with normal Safari and actual apps?

I think it just means they can run unsigned code. But yes, I would presume that Safari and the other default apps are present.
Post reply on HN