[deleted]
How to catch a wild triangle
21–30 of 46 posts
Re: How to catch a wild triangle
#22> Unfortunately, this method did not allow us to intercept HTTPS traffic of Apple services (including iMessage), as iOS implements SSL pinning for this. Thus, we were not able to decrypt iMessage traffic that came through the VPN.
When security helps attackers... that's a bit ironic.
Anyway, this article is exactly why I don't want to work in computer security, you constantly have to look behind you, and government A/government B/black hats etc will always try funny things, because they belong to side A or B or whatever, and I bet a lot of security people got either threatened or even had targets on their backs or just assassinated.
I don't really know if some of them got assassinated, because that might not make the news, but that's not a really a domain I would like to work in.
I guess it attracts people who like competition, but I don't really see the value of working in security, for the same reason I don't see the point of joining an army to learn how to fight.
Re: How to catch a wild triangle
#23> Unfortunately, this method did not allow us to intercept HTTPS traffic of Apple services (including iMessage), as iOS implements SSL pinning for this. Thus, we were not able to decrypt iMessage traffic that came through the VPN. When security helps attackers... that's a bit ironic. Anyway, this article is exactly why I don't want to work in computer security, you constantly have to look behind you, and government A…
Computer security person here! I have yet to be assassinated :)
Re: How to catch a wild triangle
#24Earlier quoted context omitted.
no way in hell the NSA forcibly tries to reinfect targets over and over, that's not their modus operandi. Instead they would have spend money to find a persistence on the infected device. The fact that the attacker has almost a full-chain but no persistence screams to me "second fiddle", probably a nation state that have access to 0-days brokers but no in-house engineering.
It wasn't clear to me from reading the blogpost that persistence _wasn't_ achieved?
They mentioned that the suspicious traffic stopped after a restart.
Re: How to catch a wild triangle
#25Earlier quoted context omitted.
no way in hell the NSA forcibly tries to reinfect targets over and over, that's not their modus operandi. Instead they would have spend money to find a persistence on the infected device. The fact that the attacker has almost a full-chain but no persistence screams to me "second fiddle", probably a nation state that have access to 0-days brokers but no in-house engineering.
Persistence on iOS is really, really hard.
I agree with you on that, but the USA (and probably China) is the nation state least likely to skimp on iOS persistence when targeting Russian AV analysts :D
Re: How to catch a wild triangle
#26> Despite many ups and downs, we eventually managed to obtain all the stages used in this attack, including four zero-day exploits reported to Apple, two validators, an implant and its modules. Looks like NSA still hasn't forgiven Kaspersky for exposing STUXNET [1]. It seems that this latest attack on Kaspersky was expensive. Losing 4 zerodays must have been painful. It's also possible that Israel and Unit 8200 [2] w…
> but my money's on the NSA
Why is your money on the NSA?
Re: How to catch a wild triangle
#27Ooh, I really enjoyed this devlog. I'd have liked to see where they pointed the finger in terms of who they think sent these off, but in case you're too lazy to read: a .watchface file sent over iMessage was used to hoist up enough power to delete all records of the iMessage and open two-way encrypted communications with a local binary. Figuring that out led to (I think?) four zero-day reports to Apple, and a substan…
[deleted]
Re: How to catch a wild triangle
#28> Unfortunately, this method did not allow us to intercept HTTPS traffic of Apple services (including iMessage), as iOS implements SSL pinning for this. Thus, we were not able to decrypt iMessage traffic that came through the VPN. When security helps attackers... that's a bit ironic. Anyway, this article is exactly why I don't want to work in computer security, you constantly have to look behind you, and government A…
Computer security person here! I have yet to be assassinated :)
Well… you would think that, wouldn’t you?
Re: How to catch a wild triangle
#29Re: How to catch a wild triangle
#30> Unfortunately for us, all the communications with the servers in question happened over HTTPS, so we could not recover any additional details from the traffic. This is why your corporate network should MitM all TLS connections by default.
(This is sarcasm, right?)
Only partially. As an employee I would resign from a company that insisted on MitM'ing my connections. But from the position of the article, it clearly would have been valuable to have request captures from the start rather than having to try to reproduce the malware a second time.