Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A deep dive into iOS Exploit chains found in the wild

googleprojectzero.blogspot.com

Post reply on HN
Print view View original

91–100 of 202 posts

Re: A deep dive into iOS Exploit chains found in the wild

#91

Post by snazz »

Wowfunhappy wrote: post #82
idoubtit wrote: post #75

Earlier quoted context omitted.

I suppose this list must be combined with the following explanation: "To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group."[^1] So the suspects are countries that fight against the autonomy of a region where the population is ethnically different. The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 mil…

> The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 million according to the UN[^2]. The dominant ethnic in China is Han, and Uygurs have been oppressed for decades. But China doesn't need exploits to spy on their iPhone-using citizens, right? Because Apple has been cooperating with the Chinese government.

Do you have some evidence of that? Aside from iCloud hosting and App Store censorship, I haven’t heard of a case where they’ve weakened security for the Chinese government.

Re: A deep dive into iOS Exploit chains found in the wild

#93

Post by feanaro »

hannob wrote: post #72
londons_explore wrote: post #66

Earlier quoted context omitted.

This is an odd list. Some big messaging apps like Signal and Line are notably missing, while tools like Mail Master and Voxer seem like pretty minor players compared to the rest. Is there a particular region of the world or community where this specific list makes most sense?

> Some big messaging apps like Signal and Line are notably missing Line is mostly used in Japan, Signal is mostly used by nerds. So you can assume neither japanese peopel nor nerd were their primary target. Given that this is true for the vast majority of the world population I'd not call this odd.

I've recently seen a surge of non-nerd Signal users. Mostly random people from my contacts starting to use it.

Re: A deep dive into iOS Exploit chains found in the wild

#94

Post by jen_h »

jen_h wrote: post #40
arkadiyt wrote: post #29

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why? edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code wa…

They own all the pipes, why bother hiding what passes through them?

After thinking about this a little longer...

Not only does the attacker have no one they care about hiding from, but also: the lack of encryption is a secondary attack.

Sure, when Vizio did this, it was probably incompetence...but here...trivially encrypting data is simple stuff, why not do it here when siphoning large streams of personal data?

Because third parties using this data to attack the tracked victims doesn’t hurt the attacker, it in fact helps them. From the state sponsored actor’s perspective, they are merely using these exploits to track minorities and dissidents, but hey, if a third party happens to find this info and use it and that keeps the victims spun up and less effective at organizing? Win-win.

Re: A deep dive into iOS Exploit chains found in the wild

#95

Post by snazz »

AnonymousPlanet wrote: post #89
londons_explore wrote: post #70

It seems the webkit renderer process goes into an infinite sleep when this exploit is used. Since iOS doesn't use a seperate renderer for different web domains/iframes, that would mean the entire tab will freeze. Surely that would be a pretty big giveaway for the user - "I was just browsing round the bombmaking-for-dummies webpage, and my browser just froze, and I had to kill it and reopen it".

Safari on iOS is pretty much the most unstable browser I have been using in the last ~5 years. I can't count how many times I had to kill and repopen Safari just because it froze on some Youtube video. So, no this is not a big giveaway. Unless something on the Youtube site targeted my own and most of my friends' iOS devices, of course.

Really? The only time I have it freeze is on early betas or when I visit a million-page-long PDF or something. I wonder if it is worse on devices with 1GB of RAM or if I’ve just gotten lucky.

Re: A deep dive into iOS Exploit chains found in the wild

#96

Post by thebruce87m »

DavideNL wrote: post #57
pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

> leveraged zero-days for iOS for years Isn't that a problem with the iOS walled garden, not even security researchers can properly investigate users devices and detect infections like this, like they can with desktop operating systems...?

I hear this a lot, but is it something that actually happens to a meaningful extent on other systems? Does it balance out the fact that black hats (and state sponsored) can find exploits that they would not have found otherwise if they didn’t have the source?

Re: A deep dive into iOS Exploit chains found in the wild

#97

Post by jen_h »

coldcode wrote: post #79

Given the depth of China's interest in controlling and accessing dissidents worldwide, I would think it highly likely that China is behind the entire exploit. What I did not see in the articles (too many to read everything) is the requirement to inject the implant from a website. Did the article indicate what sites were compromised?

Nope. But given that the write-up talks about victims being victims merely for being in a geographical region makes me immediately think about wifi portals, and ISP/telecom-injection via DNS hijacking.

We already know that ISPs routinely hijack your DNS queries to snarf your search queries, inject ads, redirect you to cached versions of big sites to “speed up your experience”, warn you of virus infection, etc etc.

It would be trivial for a state actor to use the same mechanism to redirect you to a site that, say, looks like Google, passes your search query to Google, retuns Google, but also serves up the js that pushes the implant.

Really pushes the issue that everyone — especially activists and targeted minority groups — need to be educated about DNS and proper VPN usage (a misconfigured VPN would not help here), and it would be awesome if device makers made checking and verifying this stuff easier for normal-grade users.

Re: A deep dive into iOS Exploit chains found in the wild

#98

Post by madeofpalk »

snazz wrote: post #91
Wowfunhappy wrote: post #82

Earlier quoted context omitted.

> The most obvious suspect is China: they have gulag camps in Xinjiang where Uygurs are interned, up to 1.1 million according to the UN[^2]. The dominant ethnic in China is Han, and Uygurs have been oppressed for decades. But China doesn't need exploits to spy on their iPhone-using citizens, right? Because Apple has been cooperating with the Chinese government.

Do you have some evidence of that? Aside from iCloud hosting and App Store censorship, I haven’t heard of a case where they’ve weakened security for the Chinese government.

"Aside from iCloud hosting" is a pretty big "aside"

Re: A deep dive into iOS Exploit chains found in the wild

#99

Post by axxl »

yamrzou wrote: post #55

The list of apps being monitored which are hardcoded directly in the implant[1] include : com.yahoo.Aerogram com.microsoft.Office.Outlook com.netease.mailmaster com.rebelvox.voxer-lite com.viber com.google.Gmail ph.telegra.Telegraph com.tencent.qqmail com.atebits.Tweetie2 net.whatsapp.WhatsApp com.skype.skype com.facebook.Facebook com.tencent.xin [1] https://googleprojectzero.blogspot.com/2019/08/implant-teard...

In addition though:

> The command-and-control server can also query for a list of all 3rd party apps and request uploads of their container directories.

Post reply on HN