Wow, this is a very complex exploit, involving bits of iMessage and an undocumented CPU feature that allowed the attacker to evade hardware memory protection. From what I can see, Lockdown mode would have prevented this. The attacker is ridiculously skilled regardless
Exerpts from the article missing from the bot summary:
The mass backdooring campaign, which according to Russian officials also infected the iPhones of thousands of people working inside diplomatic missions and embassies in Russia, according to Russian government officials, came to light in June. Over a span of at least four years, Kaspersky said, the infections were delivered in iMessage texts that installed malware through a complex exploit chain without requiring the receiver to take any action.
With that, the devices were infected with full-featured spyware that, among other things, transmitted microphone recordings, photos, geolocation, and other sensitive data to attacker-controlled servers. Although infections didn’t survive a reboot, the unknown attackers kept their campaign alive simply by sending devices a new malicious iMessage text shortly after devices were restarted.
The most intriguing new detail is the targeting of the […] hardware feature […]. A zero-day in the feature allowed the attackers to bypass advanced hardware-based memory protections designed to safeguard device system integrity even after an attacker gained the ability to tamper with memory of the underlying kernel.
With that many exploits being used I wouldn’t be surprised to see it is a group probably government sponsored. They love iMessage exploits as original attack vectors too.
Documentary about the pheonix software explains a lot about who used this kind of virus, mainly political figures and govermants to spy on other politicans and jornalists. The imessage exploit was known for a few years but nobody knew how the file installed itself on the device, so there was no way to figure out how to protect the device.
Wow, this is a very complex exploit, involving bits of iMessage and an undocumented CPU feature that allowed the attacker to evade hardware memory protection. From what I can see, Lockdown mode would have prevented this. The attacker is ridiculously skilled regardless
Exerpts from the article missing from the bot summary:
someone was made fun of one too many times about having green bubbles in imessage
The true villain origin story
i’m a bit of a texter myself, you know…
Seems like the definition of advanced persistent threat.
It isn’t persistent over a reboot, but the tested devices received new corrupted iMessages immediately after reboot
Persistent in APT isn’t referring to the malware itself, but rather the threat actor. I meant that this seems like a textbook APT actor.
You know what else was also super sophisticated, chained, and confident enough in it’s APT to not be persistent across reboots? DOUBLEPULSAR.
You sure?
Reminded me restart all my devices
With that many exploits being used I wouldn’t be surprised to see it is a group probably government sponsored. They love iMessage exploits as original attack vectors too.
Russian authorities say it was the Americans trying to spy on other NATO nations, Israel, and Ukraine. America spying on Russia’s enemies.
Well, I may be under the wrong impression but it occurred to me that the US govt likes to spy on everyone, friends and foes and the US citizens, too
Edit: punctuation
Documentary about the pheonix software explains a lot about who used this kind of virus, mainly political figures and govermants to spy on other politicans and jornalists. The imessage exploit was known for a few years but nobody knew how the file installed itself on the device, so there was no way to figure out how to protect the device.
Which documentary?