11–14 of 14 posts
Earlier quoted context omitted.
But this doesn’t require the attacker to have access to a cell network
And more importantly is also a lot more likely to not be detected by an ISP or similar actor.
The receiving of the data, not the sending is the most detectable part. Because you need to modify a Mac app to get the raw data.
Earlier quoted context omitted.
That doesn’t explain how the keylogger obtains the set of things uploaded. Or is it just spamming the network and hope all the updates make it? Like you don’t even know which beacon made it out
Yep, that’s pretty much it. There doesn’t seem to be a guarantee that you’ll get all the “packets”. I’m not sure what the Find My update rate is either so I don’t imagine this will be very effective to exfiltrate data.
And these things lose their value quickly once the target knows you have them so this kind of almost undetectable exfiltration is smart.
And packet loss can be mitigated with resending, and/or high amounts of parity data.
Is there more details on this attack? This part is failing the sniff test for me: > The attacker cannot manipulate the content of the location report, but he can specify the hash that is used to store the location report in the Apple network, cleverly encode the bits and bytes he wishes to transmit within the hash, and retrieve it. By retrieving the location reports, he can find out what data his keylogger has sent.…
[1] https://www.heise.de/hintergrund/c-t-deckt-auf-Keylogger-nut...