A deep dive into iOS Exploit chains found in the wild

Post by cryptozeus » Fri, Aug 30, 2019, 7:18 PM UTC

guelo wrote: post #157

cryptozeus wrote: post #128

Ever worst part is this “they really do POST everything via HTTP (not HTTPS) and there is no asymmetric (or even symmetric) encryption applied to the data which is uploaded. Everything is in the clear. If you're connected to an unencrypted WiFi network this information is being broadcast to everyone around you, to your network operator and any intermediate network hops to the command and control server.” So not only…

That's not the worst part. The worst part is the attacker getting the data. The slight chance that while you're infected you also happen to be on a public wifi in the same room at the same time as a random opportunistic hacker, or that an ISP employee is risking their job by combing through petabytes of transient customer data, is much less concerning.

Post by jen_h » Fri, Aug 30, 2019, 7:32 PM UTC

Spooky23 wrote: post #145

jen_h wrote: post #97

Earlier quoted context omitted.

Nope. But given that the write-up talks about victims being victims merely for being in a geographical region makes me immediately think about wifi portals, and ISP/telecom-injection via DNS hijacking. We already know that ISPs routinely hijack your DNS queries to snarf your search queries, inject ads, redirect you to cached versions of big sites to “speed up your experience”, warn you of virus infection, etc etc. It…

You don't need to compromise an ISP to do this stuff. Just use a shady ad-network to deliver malware or links in the same way that targeted ads are delivered. I'm not a sophisticated state actor, but I were going to try to deliver a message to a group of people, I'd use ad networks to target the geography or population that I was interested in. A bad actor could easily get a shitty ad network to deliver all sorts of…

Post by AnonymousPlanet » Fri, Aug 30, 2019, 7:49 PM UTC

snazz wrote: post #95

AnonymousPlanet wrote: post #89

Earlier quoted context omitted.

Safari on iOS is pretty much the most unstable browser I have been using in the last ~5 years. I can't count how many times I had to kill and repopen Safari just because it froze on some Youtube video. So, no this is not a big giveaway. Unless something on the Youtube site targeted my own and most of my friends' iOS devices, of course.

Really? The only time I have it freeze is on early betas or when I visit a million-page-long PDF or something. I wonder if it is worse on devices with 1GB of RAM or if I’ve just gotten lucky.

Post by feanaro » Fri, Aug 30, 2019, 8:23 PM UTC

kemayo wrote: post #159

feanaro wrote: post #150

Earlier quoted context omitted.

What features of Telegram are more pleasant? I don't use Telegram much due to its makeshift encryption scheme and bad defaults (no E2E by default), but I've found Signal extremely usable in the last year or two.

Opening up the picker for sending a picture was notably slow. Approximately a three second count from pressing the button to having the pictures available to choose from. Then similar occasional lags throughout the process (e.g. hitting "back" from a picture to return to the library and select a second picture). By contrast, Telegram has a quick selection of the last few pictures available immediately, and the genera…

Post by thinkling » Fri, Aug 30, 2019, 8:33 PM UTC

londons_explore wrote: post #65

pryce wrote: post #6

These are fascinating. It would be very interesting to know what the character and subject matter of the infecting sites were. Outside of the great tech writeup, what is particularly interesting about this, to me, from a geopolitical perspective is the level of restraint. The malicious actors in this case leveraged zero-days for iOS for years and yet do not seem to have overextended themselves or risk exposure by ove…

> the malicious actor chose to limit their intended recipients I wonder how many people you would need to infect, on average, until you were detected? I would guess, with this exploit chain, and the lack of auditing available of iOS internals, that the actual exploit could run 1 Billion + times before detection. The biggest risk is someone noticing the wedged webkit renderer process and going to try and debug it. I b…