Google Says Malicious Websites Have Been Quietly Hacking iPhones for Years

guest · Aug 29, 2019

Google Says Malicious Websites Have Been Quietly Hacking iPhones for Years
It may be the biggest attack against iPhone users yet
August 30, 2019
https://www.vice.com/en_us/article/bjwne5/malicious-websites-hacked-iphones-for-years

In what may be one of the largest attacks against iPhone users ever, researchers at Google say they uncovered a series of hacked websites that were delivering attacks designed to hack iPhones. The websites delivered their malware indiscriminately, were visited thousands of times a week, and were operational for years, Google said.

"There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant. We estimate that these sites receive thousands of visitors per week," Ian Beer, from Google's Project Zero, wrote in a blog post published Thursday.
The implant does not have persistence though; if a user reboots their iPhone, it will wipe the malware, Beer explains. But one infection can still of course deliver a treasure trove of sensitive information.

"This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years," Beer added.
Click to expand...

Google: A very deep dive into iOS Exploit chains found in the wild

guest · Aug 30, 2019

Mysterious iOS Attack Changes Everything We Know About iPhone Hacking
August 30, 2019
https://www.wired.com/story/ios-attack-watering-hole-project-zero/

Hacking the iPhone has long been considered a rarified endeavor, undertaken by sophisticated nation states against only their most high-value targets.

"This is terrifying," says Thomas Reed, a Mac and mobile malware research specialist at the security firm Malwarebytes. "We’re used to iPhone infections being targeted attacks carried out by nation-state adversaries. The idea that someone was infecting all iPhones that visited certain sites is chilling."
A New Paradigm
The attack is notable not just for its breadth, but the depth of information it could glean from a victim iPhone. Once installed, it could monitor live location data, or be used to grab photos, contacts, and even passwords and other sensitive information from the iOS Keychain.

Regardless of who may be behind it, the mass undetected hacking of thousands of iPhones should be a wake-up call to the security industry—and particularly anyone who has dismissed iOS hacking as an outlier phenomenon, unlikely to affect anyone whose secrets aren't worth a million dollars
Click to expand...

boredsecenthusiast · Aug 30, 2019

It is shocking to hear about iOS security flaw. I always thought that iOS is safe and that not vulnerable to such hacks and websites. Nevermind, I had gone through the article and certain phrase caught me attention.

According to article:

"There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant."

According to this statement I think that only if Safari have extended permission then only the hack website would be able to affect your system. I am not sure about that. Any expert can shed light on it.

Rasheed187 · Aug 31, 2019

boredsecenthusiast said: ↑

It is shocking to hear about iOS security flaw. I always thought that iOS is safe and that not vulnerable to such hacks and websites.
Click to expand...

Are you kidding me, smartphones can't be trusted. And don't forget, there are no security tools to protect you against this stuff.

Minimalist · Sep 1, 2019

Sources say China used iPhone hacks to target Uyghur Muslims

A number of malicious websites used to hack into iPhones over a two-year period were targeting Uyghur Muslims, TechCrunch has learned.

Sources familiar with the matter said the websites were part of a state-backed attack — likely China — designed to target the Uyghur community in the country’s Xinjiang state.
Click to expand...

https://techcrunch.com/2019/08/31/china-google-iphone-uyghur/

142395 · Sep 1, 2019

Almost nobody except for some experts has questioned the fact Apple's closed bug-bounty is not working. And we hear many voices on the internet saying iPhone is so secure--without much grounded evidence. It's somewhat similar to the Mac's security myth in the era before the Flashback hazard except that it is likely to be more of a targeted attack this time.

guest · Sep 1, 2019

iPhone Hackers Caught By Google Also Targeted Android And Microsoft Windows, Say Sources
September 1, 2019
https://www.forbes.com/sites/thomas...ed-android-and-microsoft-windows-say-sources/

Google’s and Microsoft’s operating systems were targeted via the same websites that launched the iPhone hacks, according to the sources, who spoke on the condition of anonymity.
That Android and Windows were targeted is a sign that the hacks were part of a broad, two-year effort that went beyond Apple phones and infected many more than first suspected.

It's unclear exactly what Android and Windows exploits were launched via the websites that were used to launch attacks on Apple's OS.
Click to expand...

Minimalist · Sep 2, 2019

The iOS zero-day exploit was real, Google’s report was bogus

“Project Zero lacked so much context it became a social attack itself.” — Rene Ritchie
Click to expand...

https://www.ped30.com/2019/09/02/apple-ios-project-zero-google/

guest · Sep 5, 2019

Apple has let down every iPhone user
The discovery that malicious websites have been able to deliver malware to iPhones for years should be a wakeup call
September 5, 2019
https://www.zdnet.com/article/apple-has-let-down-every-iphone-user/

If you're an iPhone user, Apple has let you down. Massively.

The idea that a product that Apple itself bills as being "designed from the ground up" to protect your information could have its security measures ripped to shreds by simply visiting a website, and that this happened for almost three years makes a mockery of Apple's claims of being able to protect users and their data.
A bigger embarrassment is that this attack on iPhone users was uncovered not by Apple, but by its archrival in the smartphone space, Google.

The hackers also had access to user's keychain, which contains passwords, and the databases of various end-to-end encrypted messaging apps, such as Telegram and WhatsApp.
Right now, it's impossible to know the size and scale of this attack, and how much private information belonging to users is circulating. Were you a victim? Was I? What information is now in the wild?
I don't know. And that's pretty scary.
Click to expand...

For a company that wants people to trust it with some of their most sensitive information, from personal communications to financial information to health data, Apple's silence on this matter is deeply troubling.
Click to expand...

guest · Sep 6, 2019

Apple Disputes Some Details of Google's Project Zero Report on iOS Security Vulnerabilities
September 6, 2019
https://www.macrumors.com/2019/09/06/apple-addresses-ios-vulnerabilities/

Apple today responded to Google's Project Zero blog post in an effort to address customer concerns with all of the facts.
Apple says the attack was "narrowly-focused" rather than a broad-based exploit of iPhones as described. Fewer than a dozen websites targeting Uighur Muslims were affected, according to Apple. Further, Apple says that Google created a false impression of mass exploitation, causing fear among iPhone owners.

Google also got the length of the attacks wrong. Apple says the websites were operational for approximately two months rather than two years, with the vulnerabilities fixed 10 days after Apple learned about them. Fixes were already in the works when Google approached Apple.
Click to expand...

ronjor · Sep 6, 2019

The stakes are too high for Apple to spin the iPhone exploits

By T.C. Sottek Sep 6, 2019
Apple attacks Google’s credibility instead of focusing on a vulnerable population
Click to expand...

Minimalist · Sep 7, 2019

'Indiscriminate' iOS hacking was relatively limited, Apple says. Try telling that to the Uighur population.

Apple doesn’t like what Google has been saying about Apple.

The iPhone-maker released a surprise statement on Friday refuting assertions from Google’s Project Zero researchers, who last week revealed how hackers had exploited five chains of iOS vulnerabilities to spy on “thousands” of users.
Click to expand...

https://www.cyberscoop.com/apple-indiscriminate-hacking-ios-uighur/

guest · Sep 24, 2019

Chinese hackers who pursued Uighurs also targeted Tibetans
September 24, 2019
https://www.straitstimes.com/asia/e...rs-who-pursued-uighurs-also-targeted-tibetans

Sophisticated Chinese hackers who used a previously unknown iPhone security flaw to target ethnic minority Uighurs also went after Tibetans in exile, according to a report published on Tuesday (Sept 24).

It was the first detected use of malicious software against exiled Tibetans, who are protesting against Chinese rule of the mountainous region, that required only a single click on a mobile device to work, experts at Citizen Lab said.
Using well-crafted cover stories, they tried to get the targets to click on links to websites that would have installed spyware on Apple or Android devices.
Click to expand...

guest · Apr 21, 2020

New iOS exploit discovered being used to spy on China's Uyghur minority
New "Insomnia" exploit works on iOS versions 12.3, 12.3.1, and 12.3.2; was patched in iOS 12.4 last year
April 21, 2020
https://www.zdnet.com/article/new-i...-being-used-to-spy-on-chinas-uyghur-minority/

Security firm Volexity said today that it discovered a new iOS exploit that was being used to spy on China's oppressed Uyghur minority.

The exploit, which Volexity named Insomnia, works against iOS versions 12.3, 12.3.1, and 12.3.2. Apple patched the iOS vulnerability behind this exploit in July 2019, with the release of iOS version 12.4.
Volexity said the Insomnia exploit was used in the wild between January and March 2020.

The exploit was loaded on the iOS devices of users visiting several Uyghur-themed websites. Once victims accessed the site, the Insomnia exploit was loaded on the device, granting the attacker root access.
Click to expand...

INSOMNIA EXPLOIT USED BY EVIL EYE GROUP
Volexity said the exploit was deployed by a threat actor the company is tracking under the name of Evil Eye.
The Evil Eye group is believed to be a state-sponsored hacking unit operating at Beijing's behest, and spying on China's Uyghur Muslim minority.

This is the same group that Google and Volexity discovered in August 2019 using 14 iOS exploits to target Uyghurs since at least September 2016. The 14 exploits were also deployed using a similar tactic -- using a "watering hole" technique to plant the exploit on a website and wait users to visit it.
In a new report published today, Volexity says that once Google published its report on the 14 iOS exploits, Evil Eye shut down its infrastructure and stopped using the older exploits.
Click to expand...

INSOMNIA WORKS WITH ANY WEBKIT-BASED BROWSER
The cybersecurity firm says that any iOS users who visited the Insomnia-infested websites were vulnerable to getting hacked.

"Note that exploit can be triggered through any browser on the phone, as they all use WebKit," the research team said. "Volexity was able to confirm successful exploitation of a phone running 12.3.1 via the Apple Safari, Google Chrome, and Microsoft Edge mobile browsers."
Users who visit Uyghur-themed websites and want to make sure they won't get hacked can protect themselves by updating devices to the iOS 12.4 release.
Click to expand...

Volexity: Evil Eye Threat Actor Resurfaces with iOS Exploit and Updated Implant

In the latest activity identified by Volexity, the Evil Eye threat actor used an open source framework called IRONSQUIRREL to launch their exploit chain. The exploits used targeted Apple iOS operating systems leveraging a vulnerability in WebKit that appears to have been patched in the summer of 2019. The exploit works against iOS versions 12.3, 12.3.1, and 12.3.2.

If the exploit is successful, a new version of the implant described by Google will be installed onto the device. Volexity refers to this implant by the name INSOMNIA.
Click to expand...

Conclusion
Even though the vulnerabilities exploited in this report are patched as of July 2019 with iOS version 12.4 and newer, it appears that Evil Eye is likely having success with these attacks.
According to Apple’s own statistics from its website:

• 43% of iPad devices using the App store use iOS 12 or earlier
• 30% of iPhone devices using the App store use iOS 12 or earlier
This represents a considerable attack surface of potentially vulnerable devices.

As noted in September 2019, Volexity suspected that the Evil Eye attackers had also targeted iPhones based on the attackers’ C2 servers going offline shortly after Project Zero’s findings were made public.
It can now be confirmed that in the past six months, Uyghur sites have led to malware for all major platforms, representing a considerable development and upkeep effort by the attackers to spy on the Uyghur population.
Click to expand...

Log in or Sign up

Google Says Malicious Websites Have Been Quietly Hacking iPhones for Years

guest Guest

guest Guest

boredsecenthusiast Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

142395 Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

Log in or Sign up

Google Says Malicious Websites Have Been Quietly Hacking iPhones for Years

guest Guest

guest Guest

boredsecenthusiast Registered Member

Rasheed187 Registered Member

Minimalist Registered Member

142395 Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

ronjor Global Moderator

Minimalist Registered Member

guest Guest

guest Guest

Useful Searches