13 ms·
Scan iPhone backups for traces of compromise by “Operation Triangulation”
- buildbuildbuild 3y agoCautionary note: many entities do not allow running Kaspersky software including this tool. https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations_of_Russian_government_ties https://en.wikipedia.org/wiki/Kaspersky_bans_and_allegations...
- psychphysic 3y agoOr just read the 300 lines of python it entails
- seanhunter 3y ago...and any transitive dependencies. Or you can save yourself the time and say that Kaspersky have proved themselves untrustworthy over an extended period of time and just avoid it and take everything they say as probably either propaganda or marketing or both. Even if you trust them, their product causes such extreme degredation of usability that one place I worked decided the cure is worse than the disease and removed Kaspersky from all its machines to the general celebration of all users. I was unaffected because I was the sole linux user so had been spared the Kaspersky virus on my machine.
- psychphysic 3y agoThat's a lot of accusations with few (no) sources.
- chewmieser 3y agoGood point but it's also a pretty small open source python script. Looks like everything is handled on-device in this case (at least at the time of writing this comment).
- kfrzcode 3y agoThat doesn't necessarily matter to your enterprise device usage agreement.
- AHOHA 3y agoFUD by other AV makers.
- dwater 3y agoFUD stands for Fear, Uncertainty, and Doubt. But the comment you're replying to is a factual article that lists what entities have restricted use of Kaspersky software and under what circumstances. You may think that the arguments against Kaspersky are FUD, but this post is not.
- neximo64 3y agoIts an open source python script that doesn't really fit that description
- George83728 3y agoDo you think you would enjoy the process of trying to convince a court that their laws don't apply to python scripts? (they do, btw)
- neximo64 3y agoThe fact you need to ask whether an open source python script needs a court to prove its a product and the lack of certainty is how FUD works. - What if you fork it, edit it, re-publish it as yours? - And what if other anti virus vendors do this?
- George83728 3y agoThe fact that you think you can just handwave away legal obligations like this with common sense is certainly telling. It says you don't know what you're talking about. You could reasonably assert that the government's ban of Kaspersky's software is motivated by FUD. However the ban itself is very real, violating the ban can get you into a world of trouble, so warning people to stay out of trouble for violating that ban is not FUD. Explained by analogy: Them: "Smoking marijuana can get you into trouble with the government." You: "That's just FUD, it's a harmless plant from my garden, it's not going to hurt me."
- quenix 3y agoLiteral FUD. It's a 300 line python script.
- tom_ 3y agoWritten by some people whose code you are getting paid to not run! On the plus side, since it's a 300 line Python script, you can read it (which does not involve running it), figure out what it's doing, explain it to somebody else in broad terms, and get them to write some equivalent code.
- annoyingnoob 3y agoI've committed to the US Government, in my own name, that I will not use or provide certain products. If you service a government contract that includes FAR 52.204 then you are agreeing not use Kaspersky products[0]. If you claim to be compliant and then have an incident where you've used prohibited products, the government can come after you with the False Claims Act[1]. There is no way I'm going to just download and run that script because I'm honest and I like not being in prison. [0] https://www.acquisition.gov/far/52.204-23 https://www.acquisition.gov/far/52.204-23 [1] https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-o-monaco-announces-new-civil-cyber-fraud-initiative https://www.justice.gov/opa/pr/deputy-attorney-general-lisa-...
- dfadsadsf 3y agoAccording to the link you shared, it seems Kaspersky has been prohibited solely on governmental computer systems in certain nations which Kaspersky previously revealed as deploying malware against their adversaries, correct? I doubt many on HN work for those entities and besides I am not sure Python script fit the definition of Kaspersky software.
- 8organicbits 3y agoThe US Federal government is the largest employer in the world, with well over two million civilian employees. Lots of people on HN are unable to use Kaspersky at work based on that prohibition. A carve out for python scripts is a dubious claim.
- pc86 3y agoIt's a Kaspersky repository, it's 100% Kaspersky software. Not sure how the fact that it's a Python script changes that at all.
- psychphysic 3y agoNow we just need a tool to detect Pegasus and Graphite
- eimrine 3y agoProbably NetBSD is unbreakable for them.
- dmix 3y agoContext, imessage attachment based iOS exploit: https://news.ycombinator.com/item?id=36151220 https://news.ycombinator.com/item?id=36151220 Seems pretty noisy IMO. It prevents software updates with visible errors. I wonder if its just the limitations of iOS or its a non-nation state actor. I noticed it modifies some Facetime files, I wonder if it exploits the camera through that.
- troad 3y ago> It prevents software updates with visible errors Unfortunately, given the state of the Apple first-party software, I doubt this would ring too many alarm bells. If anything, were I to start getting visible errors, I'd welcome the change from Apple's previous MO of simply silently failing.
- avodonosov 3y agoFSB statement, from the same day Kaspersky reported this exploit: https://www-fsb-ru.translate.goog/fsb/press/message/single.htm%21id%3D10439739%40fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp https://www-fsb-ru.translate.goog/fsb/press/message/single.h...
- judge2020 3y agois that a wildcard subdomain that takes the subdomain and does `s/-/./g` to proxy and translate it? Or is this only for russian media-related websites you probably don't want to be visiting directly?
- avodonosov 3y agoThat's google translate. The original is in Russian.
- pieter_mj 3y agoYes, it's a wildcard subdomain, works for every site.
- glth 3y agoDo you mean `s/./-/g`?
- NotYourLawyer 3y agoOh it’s from the Russian government, so you KNOW it’s trustworthy.
- deleted 3y ago[deleted]
- chrisfinazzo 3y agoIf you talk to certain old people - like my parents, one is 70 and other will hit the mark this November - they might say, "Russia? Like, the KGB?" and then I can quote Robbie Coltrane's Valentin in The World is Not Enough... "Now it's FSB. Federal Security Bureau. Same friendly service with a new name."
- nailer 3y ago> While monitoring the network traffic of our own corporate Wi-Fi network using the Kaspersky Unified Monitoring and Analysis Platform (KUMA), we discovered a previously unknown mobile APT campaign targeting iOS devices. What is APT in this context?
- titannet 3y agoAdvanced persistent threat.
- deleted 3y ago[deleted]
- blakesterz 3y agoAdvanced Persistent Threat. Usually very talented and patient hackers, usually state level, so government agents are commonly called APTs..
- deleted 3y ago[deleted]
- Georgelemental 3y ago"Advanced Persistent Threat"
- Veen 3y agoAdvanced persistent threat.
- iJohnDoe 3y agoAdvanced persistent threat
- londons_explore 3y agoIf I was an intelligence agency, I would have one department whose job is to 'get caught'. Ie. they use dumb methods to spy on obvious targets, like using exploits to install malware that leaves a wake of plenty of discoverable info and loudly sends data back to the mothership. I would then have another department whose job is to be as subtle as possible - for example, all their exploits are 'in ram' and all data sent back is plausibly deniable. (for example, rather than using a random 256 bit nonce while establishing an HTTPS connection to apple to check for updates, use 256 bits of encrypted data you wish to exfiltrate)
- alphaursaemin 3y agoIf I was an intelligent person, I would use a basic phone for making phone calls and not carry surveillance devices on my person or have them in my house. This way I would not have to worry about keeping up with agencies that operate above the law, are accountable to none, and operate with huge budgets to subvert the ethics and mores of capable people.
- flerchin 3y agoSo you'd make your phone calls in the clear?
- SV_BubbleTime 3y agoAre you implying that calls made from smart phones are anything but on the clear? Are you making all your voice calls using some merging other than the phone app?
- cj 3y agoA lot of people (especially outside the US) use whatsapp, etc, for calling which happens over data/wifi rather than traditional cellular.
- Tepix 3y agoMany calls are made using apps these days. WhatsApp alone had more than 15 billion voice minutes on average per day back in 2020. If your phone and the phone of the other party are not compromised, it is indeed possible to conduct end-to-end encrypted calls with perfect forward secrecy.
- transpute 3y agoThe open-source Mobile Verification Toolkit scans local iPhone/iPad backup images for filesystem IoCs (Indicators of Compromise) cataloged in STIX format, https://docs.mvt.re https://docs.mvt.re & https://github.com/mvt-project/mvt https://github.com/mvt-project/mvt > A collection of utilities to simplify and automate the process of gathering forensic traces helpful to identify a potential compromise of Android and iOS devices ... released by the Amnesty International Security Lab in July 2021 in the context of the Pegasus project along with a technical forensic methodology.. STIX IoC format, https://www.oasis-open.org/2021/06/23/stix-v2-1-and-taxii-v2-1-oasis-standards-are-published/ https://www.oasis-open.org/2021/06/23/stix-v2-1-and-taxii-v2... > The [threat intelligence] work was based initially on three specifications contributed by the US Department of Homeland Security (DHS) for development and standardization under the OASIS open standards process: STIX (Structured Threat Information Expression), TAXII (Trusted Automated Exchange of Indicator Information), and CybOX (Cyber Observable Expression). iOS IoC sources, please add to this list: https://github.com/AmnestyTech/investigations https://github.com/citizenlab/malware-indicators https://securelist.com/operation-triangulation/109842/
- slobiwan 3y agoSlightly off-topic, but how do I download an iCloud backup so I can scan it with this tool? The googles imply that I can only recover my device from the cloud, not retrieve old backups for other purposes.
- LouisEleven 3y agoMaybe this will help you? https://securelist.com/find-the-triangulation-utility/109867/ https://securelist.com/find-the-triangulation-utility/109867...
- hummer_embark 3y ago[dead]
- Tepix 3y agoWhy don't you make a local backup?
- slobiwan 3y agoOh, got it. I thought the tool wanted to go back and walk through a progression of previous backups. I can certainly do a new backup
- chrisfinazzo 3y agoLocal, encrypted backups are a thing - use them. It's debatable how useful this advice is for field agents, who might not be carrying a computer with them all the time, but for regular people it's entirely feasible.
- dagmx 3y agohow would a local, encrypted backup help here unless people were constantly doing it and also did it before they were compromised? The issue here isn’t backups. Cloud and local would be equally affected if the system is compromised.
- delfinom 3y agoYour device is infected, the backups now contain a backup of the infected device you didn't know because it was a covert tool for years. What now?
- infotogivenm 3y agoGiven how these 0days were clearly “burned” for this occasion tells me the NSA has no shortage of them.
- jerf 3y agoI think if we could somehow see all the "zero days" that are out there that all of us, and I mean, things that exist at all, not just things discovered by some human and an exploit written, even those in the industry and those well-endowed with cynicism, would be surprised. I include myself even as I expound this opinion. Just "SELECT * FROM nsa_exploits" would probably turn all our stomachs and I'd guess they still only have a small fraction of what exists. Software is to a large extent built on default-unsafe primitives, and we wrest security from them at great effort and with dubious efficacy. We still have fights on HN about whether or not "memory safety" is necessary, and that is frankly so far below the level we need to operate that it would be humorous if it weren't sad. Granted, that fight is dying down as we gradually converge on "yes, it's necessary", but it's like level 2 and we need to be operating on level 18.
- hsudvsish 3y ago> Just "SELECT * FROM nsa_exploits" would probably turn all our stomachs and I'd guess they still only have a small fraction of what exists. good thing we live in a free democratic society!
- renewiltord 3y agoWe do. And a resilient free society creates agents that it cannot police so that it can achieve its aims. No-ships are necessary for the Secher Nbiw.
- jeroenhd 3y agoI don't know about the current status quo, but three years ago Zerodium stopped buying several types of iOS exploits because of how many submissions they received: https://www.macrumors.com/2020/05/14/zerodium-pauses-acquiring-ios-exploits/ https://www.macrumors.com/2020/05/14/zerodium-pauses-acquiri... It's gotten to the point where full-chain Android exploits, traditionally easier to find and use because of lacking update policies and incompetent manufacturer chains, are worth more than their iOS counterparts: https://zerodium.com/program.html https://zerodium.com/program.html Because of iOS' excellent update rate and generally very secure operating system model, I'd expect this to mean that there are so many exploits for either platform that the trade of exploits for the ostensibly more secure platform isn't restricted by the amount of exploits anymore, but rather by the rate the existing 0day stock gets burned by use. I expect intelligence agencies to be fully stocked with more 0days than they currently need. Not just intelligence agencies either; for your average large international criminal organization, whether it's the maffia or the NSO group, there should be plenty of exploits to be found and bought.
- kornhole 3y agoThe NSA has no problem with end to end encryption as long as they can listen in on one end.
- nikcub 3y agoYou're describing the current status quo of the the e2e debate - allow e2e, but accept that the best exploits aren't going to be reported and patched, but reserved for intel agencies to use against high-value targets.
- kornhole 3y agoI am referring to the device or OS on either end rather than the client SW used for communication. When those are compromised, nothing is safe.
- kitkat_new 3y agowhat e2ee? backups are by default not e2ee
- m3kw9 3y agoIf you are someone “important”, You need to turn off iMessages as that is a huge risk factor as it’s a system app. There will always be zero click exploits and that should be all you need to know
- darknavi 3y agoIf you are "important" you should 100% run Lockdown Mode[0]. [0] https://support.apple.com/en-us/HT212650 https://support.apple.com/en-us/HT212650
- kornhole 3y agoI am important, and so are you. I am not a person of interest to state security. If you want to go next level, carefully use an anonymous phone and a data only SIM card. This makes it more difficult to identify your device to which any one click exploit can be sent to the baseband or OS.
- sampa 3y ago> I am not a person of interest to state security. you might be surprised. you don't have to be somebody important, you just might be working somewhere interesting or know somebody important. ps Snowden leaks showed NSA hacked ordinary broadband providers administrators to get access to networks, because POIs were using those providers.
- kornhole 3y agoAbsolutely. Us sysadmins have plenty of reasons to be paranoid.
- cynicalsecurity 3y agoWarming: Kaspersky is a fierce supporter of the Putin's fascist regime. His company is known for working for FSB. Think twice before running any software created by them on your computer. I would recommend to fork it, thoroughly analyse every line of code and run it on a dedicated computer without internet. Always keep in mind you can't trust them at all.
- Unkn0wnError 3y agoIt's so disheartening because there are so many brilliant and talented people that work there, and only want to do their job and don't want to be involved with politics. But it's absolutely true that Kaspersky is compromised by the Russian government, and their products and software cannot be trusted.
- AlbinoDaffy 3y agoiMazing supports same kind of scanning based on open source Mobile Verification Toolkit. Plus overall better backup management for iOS and iPadOS compared to iTunes even on free tier https://imazing.com/guides/detect-pegasus-and-other-spyware-on-iphone https://imazing.com/guides/detect-pegasus-and-other-spyware-...