Google researchers have uncovered a malicious campaign that has been targeting iPhones for at least two years. According to researchers, that particular campaign has been stopped, though they warn there may be other ways they haven't identified yet.
The security team Project Zero, announced that it had discovered some malicious websites that could be used to infringe on Apple devices, using five different personalized exploits.
The exploits used 14 different vulnerabilities spanning every version from iOS 10 to iOS 12. Apple issued an update with the iOS 12.1.4 upgrade in February after the team's researchers Project Zero revealed the vulnerabilities and gave the company a week to fix them.
The Project Zero team usually follows one strict disclosure period of 90 days, but in this case it only gave a week because of the severity of the vulnerabilities.
Google Project Zero team researcher Ian Beer reported:
A simple visit to the site was enough for an attack on your device and if the attack was successful, the device would get a malicious tracking application. We estimate that these sites had thousands of visitors a week.
The 14 vulnerabilities were present in Safari και τον πυρήνα (kernel), εκτός από δύο ξεχωριστές περιπτώσεις αποδράσεων από το sandbox, όπου ο κακόβουλος κώδικας μπορούσε να τρέξει και εκτός από τα όρια μιας εφαρμογής.
In short, the 5 exploits gave elevated “root” privileges to the attacker with full rights to install malicious preletterτα και να αποκτήσει πρόσβαση σε αρχεία της συσκευής τα οποία έστελνε κάθε 60 δευτερόλεπτα ένα διακομιστή εντολών και control.
But it is more worrying is that malware has also uploaded the device keychain, which is used to securely store data (eg Wi-Fi passwords, and certificates) from well-known applications such as WhatsApp, Telegram, Skype, Facebook , Viber, Gmail and Outlook.
______________________
- Windows Repair Toolbox: Free Windows Diagnostics and Repair
- Champion worldwide in Cybersecurity Leadership Matrix 2019 or ESET
- Common Voice from Mozilla's anti-racist voice recognition
