4 ms·
To be fair, that was just Kaspersky taking a jab at Apple, after being absolutely gutted by hackers because of their own poor security posture.
by manuelabeledo 3y ago
To be fair, that was just Kaspersky taking a jab at Apple, after being absolutely gutted by hackers because of their own poor security posture.
- saagarjha 3y agoI don’t really see anything wrong with their security posture here.
- gghffguhvc 3y agoArticle says large data files were sent from device to servers. Perhaps they could have configured their networks to detect/block this part.
- saagarjha 3y agoThis would have a very high false positive rate.
- jacooper 3y agoThey did, because they detected it using their network monitoring stack.
- nvm0n2 3y agoThe whole story starts with them detecting the anomalous network traffic, so not sure what you think they did wrong.
- gghffguhvc 3y agoI read it as it was going on for 4 years and they did 12 months of investigation leaving an unknown amount of time it went undetected.
- nvm0n2 3y agoWhat they mean is there's evidence in the captured binaries and from other victims that this campaign has been running for at least four years, not that they were compromised for four years. It actually sounds like they detected their own compromise immediately.
- deleted 3y ago[deleted]
- manuelabeledo 3y agoFor starters, it took them four years to detect an intrusion that takes advantage of a messaging service (iMessage) that wasn't the corporate choice for internal communications, and allowed the exfiltration of gigabytes of data from the C-suite and high level managers. This is Kaspersky. They had to be aware of the long history of iMessage security bugs. They could have disabled it. They chose to ignore it instead.
- saagarjha 3y agoThis is an exploit from an adversary that reversed undocumented MMIO registers to completely bypass kernel write protections. Do you honestly believe that disabling iMessage would keep them out? They’d just field the exploit using Exchange or HomeKit or any of the dozen other ways there are to get content onto the devices.
- manuelabeledo 3y ago> Do you honestly believe that disabling iMessage would keep them out? Maybe, maybe not. But it is still a testament to their poor security posture that iMessage was enabled in corporate devices, when it is not part of their software catalog. Kaspersky has tried to publicly switch blame to Apple twice in a row now. Maybe it is time for them to take some.