6 ms·

Given the depth of China's interest in controlling and accessing dissidents worldwide, I would think it highly likely that China is behind the entire exploit. W

Given the depth of China's interest in controlling and accessing dissidents worldwide, I would think it highly likely that China is behind the entire exploit. What I did not see in the articles (too many to read everything) is the requirement to inject the implant from a website. Did the article indicate what sites were compromised?

jen_h 7y ago
Nope. But given that the write-up talks about victims being victims merely for being in a geographical region makes me immediately think about wifi portals, and ISP/telecom-injection via DNS hijacking. We already know that ISPs routinely hijack your DNS queries to snarf your search queries, inject ads, redirect you to cached versions of big sites to “speed up your experience”, warn you of virus infection, etc etc. It would be trivial for a state actor to use the same mechanism to redirect you to a site that, say, looks like Google, passes your search query to Google, retuns Google, but also serves up the js that pushes the implant. Really pushes the issue that everyone — especially activists and targeted minority groups — need to be educated about DNS and proper VPN usage (a misconfigured VPN would not help here), and it would be awesome if device makers made checking and verifying this stuff easier for normal-grade users.
- Spooky23 7y ago
  You don't need to compromise an ISP to do this stuff. Just use a shady ad-network to deliver malware or links in the same way that targeted ads are delivered. I'm not a sophisticated state actor, but I were going to try to deliver a message to a group of people, I'd use ad networks to target the geography or population that I was interested in. A bad actor could easily get a shitty ad network to deliver all sorts of payloads.
  - jen_h 7y ago
    If it’s a state actor, as has been alluded to, they’re not compromising the ISP, they are the ISP. But yeah, absolutely, great point - shitty ads are doable AND geo-targetable!
glenrivard 7y ago
They would have no need https://www.amnesty.org/en/latest/news/2018/03/apple-privacy-betrayal-for-chinese-icloud-users/ https://www.amnesty.org/en/latest/news/2018/03/apple-privacy... Campaign targets Apple over privacy betrayal for Chinese ...
ttyyuuooe 7y ago
It’s probably the CIA. Looking at the list of apps monitored, there were several Chinese apps on there. Chinese companies already share all data with the government, so it doesn’t make sense China would need to waste resources and spy on them.

jen_h 7y ago

Nope. But given that the write-up talks about victims being victims merely for being in a geographical region makes me immediately think about wifi portals, and ISP/telecom-injection via DNS hijacking. We already know that ISPs routinely hijack your DNS queries to snarf your search queries, inject ads, redirect you to cached versions of big sites to “speed up your experience”, warn you of virus infection, etc etc. It would be trivial for a state actor to use the same mechanism to redirect you to a site that, say, looks like Google, passes your search query to Google, retuns Google, but also serves up the js that pushes the implant. Really pushes the issue that everyone — especially activists and targeted minority groups — need to be educated about DNS and proper VPN usage (a misconfigured VPN would not help here), and it would be awesome if device makers made checking and verifying this stuff easier for normal-grade users.

Spooky23 7y ago
You don't need to compromise an ISP to do this stuff. Just use a shady ad-network to deliver malware or links in the same way that targeted ads are delivered. I'm not a sophisticated state actor, but I were going to try to deliver a message to a group of people, I'd use ad networks to target the geography or population that I was interested in. A bad actor could easily get a shitty ad network to deliver all sorts of payloads.
- jen_h 7y ago
  If it’s a state actor, as has been alluded to, they’re not compromising the ISP, they are the ISP. But yeah, absolutely, great point - shitty ads are doable AND geo-targetable!

glenrivard 7y ago

They would have no need https://www.amnesty.org/en/latest/news/2018/03/apple-privacy-betrayal-for-chinese-icloud-users/ https://www.amnesty.org/en/latest/news/2018/03/apple-privacy... Campaign targets Apple over privacy betrayal for Chinese ...

ttyyuuooe 7y ago

It’s probably the CIA. Looking at the list of apps monitored, there were several Chinese apps on there. Chinese companies already share all data with the government, so it doesn’t make sense China would need to waste resources and spy on them.