4 ms·

Anyone know what kinds of sites were hacked to target iOS visitors to the sites, and who might have been targeted by these attacks? The blog post hints at the t

by ummonk 7y ago

Anyone know what kinds of sites were hacked to target iOS visitors to the sites, and who might have been targeted by these attacks? The blog post hints at the targeting of dissidents, but I'm not sure whether that is a general concern or actually there in these hacks.

bscphil 7y ago
> dissidents If nothing else, that would be a pretty good guess, given that amateurs don't have the skill to come up with "five separate, complete and unique iPhone exploit chains", and a professional team with the skill to create them is either going to report the vulnerabilities (white hat) or sell them on the black market, or at least try to infect a large number of people. The specificity of putting them on a single website with only "thousands" of views per week suggests that someone wanted to target visitors of that site specifically, not just for financial gain.
jen_h 7y ago
Just a wild and crazy guess here...but if you take this tweet thread: https://twitter.com/adrianzenz/status/1145778611242319874 https://twitter.com/adrianzenz/status/1145778611242319874 in context with the following hint: "To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group." (https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...) ...and then if you think about what's been going on in Hong Kong recently -- search iPhone and Hong Kong in both languages and you'll find some interesting posts on Twitter that appear not to want folks to know that: "All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them." (https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...) ...it kind of reveals itself.
- lawnchair_larry 7y ago
  What’s the relation to the first link though? That looks like an old twitter thread.
  - jen_h 7y ago
    Did you look at the screenshot and read the translation? Appears to be a real-time tracking database of Uighurs...
    - lawnchair_larry 7y ago
      In the first link? Yes, but what does the first link have to do with this attack? I see nothing that ties the two together. Am I missing something in the Google link that relates to that? The list of target services doesn’t even look similar.
      - jen_h 7y ago
        “The command-and-control server can also query for a list of all 3rd party apps and request uploads of their container directories.”

by ummonk 7y ago

bscphil 7y ago

> dissidents If nothing else, that would be a pretty good guess, given that amateurs don't have the skill to come up with "five separate, complete and unique iPhone exploit chains", and a professional team with the skill to create them is either going to report the vulnerabilities (white hat) or sell them on the black market, or at least try to infect a large number of people. The specificity of putting them on a single website with only "thousands" of views per week suggests that someone wanted to target visitors of that site specifically, not just for financial gain.

jen_h 7y ago

Just a wild and crazy guess here...but if you take this tweet thread: https://twitter.com/adrianzenz/status/1145778611242319874 https://twitter.com/adrianzenz/status/1145778611242319874 in context with the following hint: "To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group." (https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...) ...and then if you think about what's been going on in Hong Kong recently -- search iPhone and Hong Kong in both languages and you'll find some interesting posts on Twitter that appear not to want folks to know that: "All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them." (https://googleprojectzero.blogspot.com/2019/08/a-very-deep-dive-into-ios-exploit.html https://googleprojectzero.blogspot.com/2019/08/a-very-deep-d...) ...it kind of reveals itself.

lawnchair_larry 7y ago
What’s the relation to the first link though? That looks like an old twitter thread.
- jen_h 7y ago
  Did you look at the screenshot and read the translation? Appears to be a real-time tracking database of Uighurs...
  - lawnchair_larry 7y ago
    In the first link? Yes, but what does the first link have to do with this attack? I see nothing that ties the two together. Am I missing something in the Google link that relates to that? The list of target services doesn’t even look similar.
    - jen_h 7y ago
      “The command-and-control server can also query for a list of all 3rd party apps and request uploads of their container directories.”