4 ms·

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be inten

14 iOS exploits, including 0-days, and they upload all data to their C2 using plaintext http? With this level of sophistication I feel like it can only be intentional, but why? edit: their implant is compiled unoptimized, has NSLog statements, serializes data by writing everything as files to /tmp (a "rather odd design pattern", as Ian Beer put it), in addition to the http issue just described. The implant/C2 code was likely written by a separate, less experienced team, than the one that wrote the exploit chains (which might have simply been purchased?).

pjlnotsecure 7y ago
It leaves me in awe how good some hackers are, until it comes to hardening a Linux Server. The difference is astounding. Not knowing how to setup SSL on Apache, not knowing how to enable UFW (lol it’s “sudo ufw enable”), etc. Never was sure why that dichotomy was there. Then again I’m a terrible pentester but am very good at Linux.
jen_h 7y ago
They own all the pipes, why bother hiding what passes through them?
- jen_h 7y ago
  After thinking about this a little longer... Not only does the attacker have no one they care about hiding from, but also: the lack of encryption is a secondary attack. Sure, when Vizio did this, it was probably incompetence...but here...trivially encrypting data is simple stuff, why not do it here when siphoning large streams of personal data? Because third parties using this data to attack the tracked victims doesn’t hurt the attacker, it in fact helps them. From the state sponsored actor’s perspective, they are merely using these exploits to track minorities and dissidents, but hey, if a third party happens to find this info and use it and that keeps the victims spun up and less effective at organizing? Win-win.
lawnchair_larry 7y ago
Because the entity who supplied the exploit has no relation to the entity who supplies the implant and control framework. The latter is commodity developer work, easily done in house or via a defense contractor. It’s not unlikely that the exploit developer had no idea what it was being used in or how.
- dmix 7y ago
  In my experience infosec people tend to be pretty awful programmers. They are experts at mining other people's code bases for common exploit patterns but not so great at the wider systems/engineering stuff. But agreed it was probably purchased from some vuln dev and put together by some hack gov employee with some Microsoft certifications or (far less likely) some indifferent blackhat with powerful weapons well out of his scope, although 'black market zero day markets' are mostly non-existent hype. Especially for multiple iOS vulns. There's a good reason the cost of those exploits is so high given the low level of programming talent around in security. Watering holes + "targeting sub-communities" typically mean spies hitting up some conference website or industry news thing. Who knows what country they are in and how sophisticated their local CS people are.
  - londons_explore 7y ago
    > In my experience infosec people tend to be pretty awful programmers. Awful at using good design patterns, unit tests, and neat code maybe... But not "write everything to /tmp, tar it up and upload it cleartext".
  - lostgame 7y ago
    Cleartext is the issue, here. Even the most basic infosec folk will be aware to not do that - what this does is, as others have said, reveal that the developers were not the ones who found the exploit - it was likely simply purchased.
eitland 7y ago
> With this level of sophistication I feel like it can only be intentional, but why? Hehe, I have an idea, it is kind of crazy so I assign it <10% probability but if I where right it seems to kind of work: Plausible deniability. We all "know" that well funded three letter agencies wouldn't let shoddy work like this pass. As long as you aren't afraid that anyone will capture it in transit this is a good way to avoid suspicion. Which could explain why it was so overdone, to make sure everybody sees how unlikely it is that a state actor have done it.

pjlnotsecure 7y ago

It leaves me in awe how good some hackers are, until it comes to hardening a Linux Server. The difference is astounding. Not knowing how to setup SSL on Apache, not knowing how to enable UFW (lol it’s “sudo ufw enable”), etc. Never was sure why that dichotomy was there. Then again I’m a terrible pentester but am very good at Linux.

jen_h 7y ago

They own all the pipes, why bother hiding what passes through them?

jen_h 7y ago
After thinking about this a little longer... Not only does the attacker have no one they care about hiding from, but also: the lack of encryption is a secondary attack. Sure, when Vizio did this, it was probably incompetence...but here...trivially encrypting data is simple stuff, why not do it here when siphoning large streams of personal data? Because third parties using this data to attack the tracked victims doesn’t hurt the attacker, it in fact helps them. From the state sponsored actor’s perspective, they are merely using these exploits to track minorities and dissidents, but hey, if a third party happens to find this info and use it and that keeps the victims spun up and less effective at organizing? Win-win.

lawnchair_larry 7y ago

Because the entity who supplied the exploit has no relation to the entity who supplies the implant and control framework. The latter is commodity developer work, easily done in house or via a defense contractor. It’s not unlikely that the exploit developer had no idea what it was being used in or how.

dmix 7y ago
In my experience infosec people tend to be pretty awful programmers. They are experts at mining other people's code bases for common exploit patterns but not so great at the wider systems/engineering stuff. But agreed it was probably purchased from some vuln dev and put together by some hack gov employee with some Microsoft certifications or (far less likely) some indifferent blackhat with powerful weapons well out of his scope, although 'black market zero day markets' are mostly non-existent hype. Especially for multiple iOS vulns. There's a good reason the cost of those exploits is so high given the low level of programming talent around in security. Watering holes + "targeting sub-communities" typically mean spies hitting up some conference website or industry news thing. Who knows what country they are in and how sophisticated their local CS people are.
- londons_explore 7y ago
  > In my experience infosec people tend to be pretty awful programmers. Awful at using good design patterns, unit tests, and neat code maybe... But not "write everything to /tmp, tar it up and upload it cleartext".
- lostgame 7y ago
  Cleartext is the issue, here. Even the most basic infosec folk will be aware to not do that - what this does is, as others have said, reveal that the developers were not the ones who found the exploit - it was likely simply purchased.

eitland 7y ago

> With this level of sophistication I feel like it can only be intentional, but why? Hehe, I have an idea, it is kind of crazy so I assign it <10% probability but if I where right it seems to kind of work: Plausible deniability. We all "know" that well funded three letter agencies wouldn't let shoddy work like this pass. As long as you aren't afraid that anyone will capture it in transit this is a good way to avoid suspicion. Which could explain why it was so overdone, to make sure everybody sees how unlikely it is that a state actor have done it.