How to catch a wild triangle • Hacker News Board

Re: How to catch a wild triangle

#11

Post by Jerry2 » Fri, Oct 27, 2023, 8:20 AM UTC

>Despite many ups and downs, we eventually managed to obtain all the stages used in this attack, including four zero-day exploits reported to Apple, two validators, an implant and its modules.

Looks like NSA still hasn't forgiven Kaspersky for exposing STUXNET [1]. It seems that this latest attack on Kaspersky was expensive. Losing 4 zerodays must have been painful. It's also possible that Israel and Unit 8200 [2] was behind this but my money's on the NSA.

[1] https://eugene.kaspersky.com/2011/11/02/the-man-who-found-st...

[2] https://www.washingtonpost.com/world/national-security/israe...

Re: How to catch a wild triangle

#12

Post by yorwba » Fri, Oct 27, 2023, 9:01 AM UTC

LoganDark wrote: post #8

sllabres wrote: post #7

Earlier quoted context omitted.

A bit further down in the same article: "Unfortunately, this method did not allow us to intercept HTTPS traffic of Apple services (including iMessage), as iOS implements SSL pinning for this"

It would have allowed them to intercept those bogus malware domains though.

It did.

Re: How to catch a wild triangle

#13

Post by gdprrrr » Fri, Oct 27, 2023, 9:12 AM UTC

LoganDark wrote: post #4

> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic. This is why your corporate network should MitM all TLS connections by default.

The risk of getting your MitM box compromised is too high IMO

Re: How to catch a wild triangle

#14

Post by luch » Fri, Oct 27, 2023, 9:14 AM UTC

Jerry2 wrote: post #11

> Despite many ups and downs, we eventually managed to obtain all the stages used in this attack, including four zero-day exploits reported to Apple, two validators, an implant and its modules. Looks like NSA still hasn't forgiven Kaspersky for exposing STUXNET [1]. It seems that this latest attack on Kaspersky was expensive. Losing 4 zerodays must have been painful. It's also possible that Israel and Unit 8200 [2] w…

no way in hell the NSA forcibly tries to reinfect targets over and over, that's not their modus operandi. Instead they would have spend money to find a persistence on the infected device.

The fact that the attacker has almost a full-chain but no persistence screams to me "second fiddle", probably a nation state that have access to 0-days brokers but no in-house engineering.

Re: How to catch a wild triangle

#15

Post by munchinator » Fri, Oct 27, 2023, 9:15 AM UTC

Fascinating reading.

Would love to see a subsequent post in this series about attribution. Are there any code or other TTP similarities to APTs from known actors?

Re: How to catch a wild triangle

#16

Post by munchinator » Fri, Oct 27, 2023, 9:50 AM UTC

In terms of prevention strategies, it seems that given that the initial vector was a malicious iMessage attachment, Lockdown Mode would have prevented this attack? (As it disables iMessage attachments).

Re: How to catch a wild triangle

#17

Post by saagarjha » Fri, Oct 27, 2023, 9:56 AM UTC

luch wrote: post #14

Jerry2 wrote: post #11

> Despite many ups and downs, we eventually managed to obtain all the stages used in this attack, including four zero-day exploits reported to Apple, two validators, an implant and its modules. Looks like NSA still hasn't forgiven Kaspersky for exposing STUXNET [1]. It seems that this latest attack on Kaspersky was expensive. Losing 4 zerodays must have been painful. It's also possible that Israel and Unit 8200 [2] w…

no way in hell the NSA forcibly tries to reinfect targets over and over, that's not their modus operandi. Instead they would have spend money to find a persistence on the infected device. The fact that the attacker has almost a full-chain but no persistence screams to me "second fiddle", probably a nation state that have access to 0-days brokers but no in-house engineering.

Persistence on iOS is really, really hard.

Re: How to catch a wild triangle

#18

Post by munchinator » Fri, Oct 27, 2023, 10:17 AM UTC

luch wrote: post #14

Jerry2 wrote: post #11

> Despite many ups and downs, we eventually managed to obtain all the stages used in this attack, including four zero-day exploits reported to Apple, two validators, an implant and its modules. Looks like NSA still hasn't forgiven Kaspersky for exposing STUXNET [1]. It seems that this latest attack on Kaspersky was expensive. Losing 4 zerodays must have been painful. It's also possible that Israel and Unit 8200 [2] w…

no way in hell the NSA forcibly tries to reinfect targets over and over, that's not their modus operandi. Instead they would have spend money to find a persistence on the infected device. The fact that the attacker has almost a full-chain but no persistence screams to me "second fiddle", probably a nation state that have access to 0-days brokers but no in-house engineering.

It wasn't clear to me from reading the blogpost that persistence _wasn't_ achieved?

Re: How to catch a wild triangle

#19

Post by j16sdiz » Fri, Oct 27, 2023, 10:20 AM UTC

reactordev wrote: post #3

I wasn't expecting this. I was expecting just a simple post about some errant process or something. What I ended up reading was a digital version of a sherlock holmes novel. Complete with the mouse trap. The use of mitmproxy to intercept and unpack https requests like a russian doll is the most russian solution, and it worked like a charm. Thanks for including the juicy bits that make these discoveries actually worth…

Use of mitmproxy is very fragile. Cert Pinning is increasing common.

Re: How to catch a wild triangle

#20

Post by djoldman » Fri, Oct 27, 2023, 10:21 AM UTC

I've always felt that security/exploit devs are just different.

This kind of constant striving and failing until finally succeeding would be such an incredibly frustrating experience for me.

Kudos to them though, it's serious perseverance.