How to catch a wild triangle
securelist.com
How to catch a wild triangle
1–10 of 46 posts
Re: How to catch a wild triangle
#2Ooh, I really enjoyed this devlog.
I'd have liked to see where they pointed the finger in terms of who they think sent these off, but in case you're too lazy to read: a .watchface file sent over iMessage was used to hoist up enough power to delete all records of the iMessage and open two-way encrypted communications with a local binary.
Figuring that out led to (I think?) four zero-day reports to Apple, and a substantial homegrown MITM proxy poisoner designed specifcally to compromise the encryption used to protect the exploit server's comms channel with the devices.
Just because you're paranoid doesn't mean they aren't out to get you if you're Kaspersky, I guess.
Re: How to catch a wild triangle
#3I wasn't expecting this. I was expecting just a simple post about some errant process or something. What I ended up reading was a digital version of a sherlock holmes novel. Complete with the mouse trap. The use of mitmproxy to intercept and unpack https requests like a russian doll is the most russian solution, and it worked like a charm. Thanks for including the juicy bits that make these discoveries actually worth reading. Also scary that once hoisted, the binary is just transmitting all your data to them.
Re: How to catch a wild triangle
#4> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic.
This is why your corporate network should MitM all TLS connections by default.
Re: How to catch a wild triangle
#5What did the watchface exploit actually do?
Re: How to catch a wild triangle
#6> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic. This is why your corporate network should MitM all TLS connections by default.
Then you have other problems.
Re: How to catch a wild triangle
#7> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic. This is why your corporate network should MitM all TLS connections by default.
A bit further down in the same article:
"Unfortunately, this method did not allow us to intercept HTTPS traffic of Apple services (including iMessage), as iOS implements SSL pinning for this"
Re: How to catch a wild triangle
#8> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic. This is why your corporate network should MitM all TLS connections by default.
A bit further down in the same article: "Unfortunately, this method did not allow us to intercept HTTPS traffic of Apple services (including iMessage), as iOS implements SSL pinning for this"
It would have allowed them to intercept those bogus malware domains though.
Re: How to catch a wild triangle
#9What did the watchface exploit actually do?
Presumably send all device data, use the sensors to spy on the phone's surroundings, and be ready for further instructions.
Re: How to catch a wild triangle
#10> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic. This is why your corporate network should MitM all TLS connections by default.
(This is sarcasm, right?)