11 ms·
Apple alerts users in 92 nations to mercenary spyware attacks
- blakesterz 3y agoIf I got a message that said: “Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple ID -xxx-,” it wrote in the warning to affected customers." I would assume it's fake, part of some phishing scam. How can we know something like this is real? I'd be even more likely to think it's fake if it looks different than all the other messages I get. Edited to add: As a comment below pointed out if you "sign in to appleid.apple.com" it'll confirm, which even I would trust! Thanks to quitit for pointing that out.
- speedgoose 3y agoBut if the phishing scam manages to display such a message in a different way on your phone, you can’t trust the phone anymore as it has likely been hacked.
- __jonas 3y agoOn the Apple Support page here: https://support.apple.com/en-in/102174 https://support.apple.com/en-in/102174 In the screenshot it says the threat notification was sent "via email and iMessage", so it would not be displayed in any different way on your phone, which I also find surprising. I definitely wouldn't expect to receive something like this as an Email, and I have turned off iMessage.
- the_mar 3y agoJust out of curiosity why would you have imessage turned off?
- w0m 3y agoUnless things have changed since I last looked, if those you talk to aren't also on iMessage, it feels like a net negative to use as you get inconsistent/negative behavior between contacts. From that end, it becomes sort of a moral issue with the clearly arbitrarily locked gates and poor experiences. So you disable and use a non-malicious and cross platform solution.
- rootusrootus 3y agoApple is malicious, but Facebook is totally okay?
- dqv 3y ago> Apple is malicious, but Facebook is totally okay? This is such a bizarre comment to make, because OP never suggested that Facebook is "totally okay". You replied to them after their edit window passed, so they didn't say that and then edit it out either.
- w0m 3y agoApple explicitly and actively making what should be a 'standard' text message experience worse on non-apple devices is malicious. FB Messenger is simply an alternative. I haven't paid attention to it, but maybe the Threads fediverse integration will piss me off just as much.
- sneak 3y agoiMessage histories are backed up in the nightly automatic non-e2ee iCloud Backup, effectively backdooring iMessage’s “end to end encryption” by escrowing the plaintext to a not-endpoint. Apple can read approximately everyone’s iMessages out of their backups. It’s not private or secure, and claiming it is end to end encrypted is misleading almost to the point of being actually false.
- ZekeSulastin 3y agoAlbeit recent and optional, isn’t that a hole specifically fixed by the Advanced Data Protection option[0]? Granted, it doesn’t do much if your recipients don’t also have it enabled. 0: https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651
- unicon 3y agoI heard it should show as a badge/banner on top of your iCloud Web Panel in the browser. Edit: on top of the message you get
- c0t300 3y agoat the end it says that you can check the validity by signing in to icloud, there an alert banner is shown
- quitit 3y ago> How can we know something like this is real? From apple's website: "To verify that an Apple threat notification is genuine, sign in to appleid.apple.com. If Apple sent you a threat notification, it will be clearly visible at the top of the page after you sign in." https://support.apple.com/en-lamr/102174 https://support.apple.com/en-lamr/102174
- grecy 3y agoAs long as it doesn't have any links to click or try to force you to login to something, it just sounds like information to me. If my bank sent me something about Credit Card fraud I would be very skeptical if it had a big "CLICK HERE TO LOGIN" type of thing. But if it was just info, and maybe ended with "Contact your local branch to learn more", but no links, no phone numbers, etc. I would be less skeptical.
- jayrot 3y agoThis is, I think, a valuable heuristic. Anything but the most complex and long-term scam always includes some call to action, nearly always URGENT and IMMEDIATE (so as not to give you a chance to think about it or research it). A notification that is ONLY a notification about something is very unlikely to be malicious (though could certainly be erroneous). My bank will send me a concerning email or SMS about suspicious activity that needs to be reviewed or confirmed, but because they know it's a vector for attack their specifically ask you to call them at their published number listed on your card.
- world2vec 3y agoDoesn't say which 92 nations tho.
- scoot 3y agoI thought it odd that the end-user message mentioned it at all. Compared to last years message it strays into editorial content.
- Vicinity9635 3y ago[dead]
- bee_rider 3y agoThere’s a reddit thread by somebody who got one of these: https://old.reddit.com/r/iphone/comments/1c10jai/i_have_received_two_messages_from_apple_stating/ https://old.reddit.com/r/iphone/comments/1c10jai/i_have_rece... The interesting thing IMO is they claim to just be some random college student. Which seems believable because if they were a real secret squirrel I guess they wouldn’t ask reddit about it, haha. I wonder if the hackers are targeting people based on phone numbers or something. (I could imagine a college student recently getting a new number and ending up with one that’d been associated with a target—I guess? Although you’d hope there’d be a way to retire numbers that are known to be targets).
- Despegar 3y agoWell the they might be just a college student, but they could have a relationship with the actual target in some way. And if it's part of a complex operation they could be trying some indirect approaches.
- passion__desire 3y agoOr maybe have a bigger blast radius so that it is difficult to know the exact targets. Drown the detection algos in the noise.
- ethbr1 3y agoExactly. If you're identifying targets by noisy proxy signals (geo/IP + behavior?) then you're going to have non-zero false positives.
- alwillis 3y ago> Well the they might be just a college student, but they could have a relationship with the actual target in some way. People who are "just" college students often are the sons and daughters of people who could be targeted. Not to mention people in their social circles.
- CPLX 3y agoIf you want to get someone to click a link or open a photo/video having it sent to them by their nanny for example would seem pretty effective.
- pksebben 3y agoBetween the Metaverse, "mercenary spyware", AI war targeting, and death drones, I keep wondering who it is that read Neuromancer and thought; "What a rosy picture! How can we realize this stunning vision of a future-to-be?"
- jsheard 3y agoSci-Fi Author: In my book I invented the Torment Nexus as a cautionary tale Tech Company: At long last, we have created the Torment Nexus from classic sci-fi novel Don't Create The Torment Nexus https://twitter.com/AlexBlechman/status/1457842724128833538 https://twitter.com/AlexBlechman/status/1457842724128833538
- rchaud 3y agoSame goes for certain types of lead characters in things like American Psycho, Fight Club, Mad Men and Wolf of Wall St. These are seen as aspirational instead of cautionary tales.
- unholythree 3y agoI go to a restaurant where the owner has recently hung a sign reading “The World is Yours” as though Tony Montana from Scarface should be regarded a fount of wisdom.
- philistine 3y agoIf you want to deify Tony Montana, there is one quote that is the John 3:16 of his proselytizing, and the world is yours is not that quote. I guess you can't put it in a restaurant.
- FabHK 3y agoAnd, famously, Michael Lewis's first book, "Liar's Poker": > Despite the book's quite unflattering depiction of Wall Street firms and many of the people who worked there, many younger readers were fascinated by the life depicted. Many read it as a "how-to manual" and asked the author for additional "secrets" that he might care to share. https://en.wikipedia.org/wiki/Liar%27s_Poker#Reception https://en.wikipedia.org/wiki/Liar%27s_Poker#Reception
- 1970-01-01 3y agoGood way to get Pegasus devs to blink, but nothing more.
- t-sauer 3y agoMaybe my thinking is a bit naive, but I would assume that the message signals that Apple found a new way to identify (and therefore maybe neutralize) Pegasus which is probably at least a medium annoyance to them.
- vinay_ys 3y agoIf you were the hacker operating a remote command and control for such a targeted attack, you would immediately know if Apple or some other mechanism silently blocked your exploit kill chain. This notification to users tells you nothing new. If something doesn't work, you move on to the next exploit available to you. It's not likely that they would shut shop and go away just because apple notified users. Only thing this does is Apple gets more users to turn on their protection mechanisms like lockdown mode which makes it more valuable to find vulnerabilities in that (as that is the new baseline now). And so goes the tale. It's a never ending escalatory game.
- sigspec 3y agoPegasus and NSO. (Edit: of course I'm flagged for this. Surprise surprise)
- deleted 3y ago[deleted]
- freedomben 3y agoI spend way too much time on HN, and having seen how often flags are abused or simply used too liberally, I think they are way too over powered. A lot of good discussion gets killed by flags right it of the gate. Sometimes it gets vouched and redeemed, but the vast majority of the time the damage is done and that comment or story languishes in obscurity.
- pvg 3y agoThe comment doesn't really say anything and the commenter is not saying they edited the comment to make it just non-substantive rather than non-substantive and inflammatory.
- freedomben 3y agoExcellent point. Thank you! I would hope people aren't using flags for low-value comments, but you make a great point that it could have been edited to remove something that was deserving of a flag.
- Kbelicius 3y agoSaw it while it was flagged. There were two sentences. They removed the second one. Cant remember the exact wording, it was a short one, but it was basically saying: "Israel bad".
- freedomben 3y agoAh thanks, that does indeed sound flag-worthy
- t-sauer 3y agoIf someone is interested how the message actually looks like, a user on reddit posted it and a previous version from 2023 (although it doesn't include everything): https://www.reddit.com/r/iphone/comments/1c10jai/i_have_received_two_messages_from_apple_stating/ https://www.reddit.com/r/iphone/comments/1c10jai/i_have_rece...
- ryandrake 3y agoIt looks like the message encourages users to update "to the latest software version, iOS 16.6." I wonder if their message is different to users on devices which no longer can be updated beyond iOS 15, like iPhone 7, 7 Plus, SE and so on.
- kmeisthax 3y agoNote that "mercenary spyware" is the politically correct term Apple chose for "state-sponsored attacker" because Modi complained that Apple was exposing them for using illegal NSO Group spyware.
- loceng 3y agoThe power of language, where "state-sponsored" too accurately directs the population's attention to their government but where mercenary is vague and non-aiming - where a simple change in language is enough to quell that ire and attention of authoritarians; or should I say authoritarian behaviour to not out them directly as authoritarians?
- FpUser 3y agoSo you're saying that non authoritarian governments do not sponsor or do themselves the spying / attacks?
- miohtama 3y agoApple needs to work with authoritarian governments, or nobody is going to build our iPhones. I would guess it’s obvious for everyone who gets the message that they are political targets. However it is also important to call out abuse of power, like is in the case of India, Spain, Poland, where the governing party is spying the opposition in order to find ways to get rid of them.
- nehal3m 3y ago> Apple needs to work with authoritarian governments, or nobody is going to build our iPhones. Not only is this objectively true, I also have an iPhone. It's not news to me but it still makes me do a double take every time. Maybe I should try oscillating to Linux and FairPhone again...
- tombert 3y agoI think as of right now, it's nearly impossible to buy a guilt-free computer of any kind. It's a spectrum, obviously, but I think if you were to audit every component of any computer you buy from basically any company, you'd eventually get something kind of depressing. A relative of mine in the defense industry has told me that, generally speaking, the DoD requires that none of the components in missiles have parts manufactured by potential adversaries, which makes enough sense but is also extremely difficult now.
- resource_waste 3y agoI suppose this is an alternative to security... Real 'Scroll to the bottom of the terms and click accept" vibes.. Is there any company as big as Apple with so many major security issues?
- hiatus 3y ago> Is there any company as big as Apple with so many major security issues? To be fair, does any Android device alert you to a compromise like this?
- resource_waste 3y agoAndroid is more secure, especially in recent history. You can even see it in 0 day bounties. Don't pay attention to Samsung though, that company is probably the Apple equivalent of android.
- saagarjha 3y agoI don’t see how the bounties back this up?
- resource_waste 3y agoSupply and demand.
- rootusrootus 3y agoThe bounties look like they have fairly comparable distribution, and just knowing the dollar figures doesn't really tell much about either supply or demand. Your inference requires that knowledge.
- resource_waste 3y ago>just knowing the dollar figures doesn't really tell much about either supply or demand. Well we just broke econ
- Lendal 3y agoPet peeve: This story alternates between "nations" and "countries" as if they were synonyms. A nation is a group of people sharing cultural, ethnic, and historical ties. There are many more nations than there are countries, especially within the US. A country has a political boundary, a flag and an anthem. It's one thing to use a word in the wrong way, because maybe you don't know the other word exists, and that's okay. But it's really annoying to hear both words being used in the same story but alternating them, without any explanation as to why. Is this an AI generated story?
- vineyardmike 3y agoWith all due respect, I’ve simply never heard anyone use these terms “correctly”. I live in an English-speaking country, and the closest thing I’ve seen to this is university signs that say things like “this is tiger nation” or something similar. But I’ve also seen people use “country” to express that too. I assume they’re alternating not because it’s AI written but because the author considered them synonymous and wanted it to sound less repetitive. These words are just so overloaded that I think this is a lost battle. People hike in the back-country, you can live in the city or the country. And frankly if you used “nation” to represent a cultural group of people in almost any context I think people would not understand or worse - assume you were stoking some racial angst or land-dispute.
- dragonwriter 3y agoPet peeve: Misguided pedantry Both “country” and “nation” have a wide variety of definitions, and several of them overlap. The definition you give for “nation” is a particular technical one used in certain contexts, but the word used for the way you define “country” in the context where that kind of technical definition is being used for “nation” is “state”, not “country”. (And even “state” may be used with additional qualifiers to disambiguate the exact sense when used for that, because it is a heavily-overloaded term.)
- gamepsys 3y agoPet peeve: Not enough pedantry with language use in publications. Nation and country are not interchangeable. Words have meaning. Good journalist choose their words deliberately and have a deeper understand of language than the average person.
- _the_inflator 3y ago"Mercenary spyware attacks, such as those using Pegasus from the NSO Group, are exceptionally rare and vastly more sophisticated than regular cybercriminal activity or consumer malware" So, maybe even provoking an Apple warning to those targets could also be part of a sophisticated operation. These targets react or have to react in a certain way. Instigate to lure people out of hiding and entice them to react, even if only to observe their behavior. What do these targeted people do then? Switching phones? Accessing certain digital services, warning their network via conventional lines? From an observer's perspective, this is pretty thrilling.
- resource_waste 3y ago>What do these targeted people do then? Switching phones? When you can get a $130 Motorola that has better security... Yes. Since the 2018 iphone crack by the FBI, I am shocked anyone uses their iphone for secrets.
- dieortin 3y agoI doubt a 6 year old phone with outdated OS will be more secure than an up to date iPhone
- resource_waste 3y agoWhy are you comparing 6 year old phones?
- FabHK 3y agoThe 2018 crack that one can foil by picking a decent passphrase instead of a 4-digit number?
- itscodingtime 3y agoIs there a modern smartphone or cellphone the fbi, cia, nsa any nation state can not hack ? I can guarantee you the fbi can also hack a $130 motorolla.
- neilv 3y agoIs this spyware possible due to engineering flaws in Apple products?
- wepple 3y agoTechnically, yes? But there has never ever been non-trivial software that has been completely free of such defects. In other words (in my opinion), iOS is probably better than most other platforms against this type of attack.
- fckgw 3y agoI guess? Every platform has bugs and zero days.
- Maximus9000 3y agoCheck out Darknet diaries podcast on the NSO group. NSO group likely pays over $100k USD to hackers that have a good zero day for iphone. https://darknetdiaries.com/episode/100/ https://darknetdiaries.com/episode/100/
- Etheryte 3y agoPretty much every computer virus, worm, etc ever has been due to engineering flaws in software products. All software ever made has bugs in it, including whatever you're using right now.
- FunkyFunTimes 3y agoHere’s hoping that this isn’t any sort of psychological warfare tactic which Apple has been pressurised to sow into making groups of people assume blame at certain groups for the purpose of swaying elections in certain ways. Because God knows how many times Five Eyes have tampered with elections across the Middle East in the past 50 years. I wouldn’t be naive to believe everything totally and just putting another perspective out there which may be worth considering (even for just a few seconds).
- ein0p 3y agoI’d think this extends to all countries actually, and find it curious that only 92 are being notified.
- dylan604 3y agoCould this be illegal in some countries to notify users like this? I could see how revealing to some one they were the subject of a gov't targeting would be illegal in some countries.
- spxneo 3y agoIt's probably far worse with Android users that Google is not disclosing. I'm seriously considering changing to Apple after this. Not that its secure but that they are willing to go to this length to communicate it.
- ipaddr 3y agoAre you a journalist or high profile target? If not, this notification isn't for the average person.
- gxs 3y agoWhy is it hard to see that while he may not be a target for any sort of state sponsored attack, it’s a bellwether of apples stance on security. I really, really don’t think he meant he was switching to Apple because he’s a CIA spy stationed in Moscow.
- spxneo 3y ago> CIA spy stationed in Moscow. Чёрт побери!
- scrollaway 3y agoRight it’s unthinkable you’d find high profile targets on hacker news. All you’ll find here are founders of highly funded startups and software developers at boring companies such as Google, Microsoft and Apple. No point getting into these people’s phones if you’re a state actor for sure /shrug
- consumer451 3y agoYou don't need to be a journalist. I think many tech workers are oblivious to how juicy and obvious a target we are. Most of us publish a detailed target on our own back via LinkedIn, or our company's website About Us and Clients pages. Long ago, I co-founded a tiny startup. We had some high profile clients. I was dumb enough to put those clients on our site. I also used to be dumb enough to have a public social media profile, in my name. I was already somewhat security aware, but one day I almost fell for a spear phishing email. Someone created a gmail account 1 character different from my gf's gmail. They sent me a well worded, but simple email along the lines of "Hey baby, check this out!" and URL shortened link. She happened to be next to me, and I said to her "Hey, what's this?" "What? I didn't send that!" I then opened it in a VM and saw that it resolved to something.ru. It was a combo of identifying the juicy client of ours, seeing my name as co-founder, finding me on FB, finding my gf in my profile, getting her email, etc. I then got to learn fun new terms like threat modeling. Is it possible that someone might think that you have ssh access to a server on an interesting network? You are a target.
- Animats 3y agoThe message from Apple is so vague that it's useless. It just says to be afraid. There's no advice on what action to take.
- filenox 3y agoThat's not true, in the message they refer you to a web page with more details: About Apple threat notifications and protecting against mercenary spyware -https://support.apple.com/en-in/102174 https://support.apple.com/en-in/102174
- Vicinity9635 3y ago[dead]
- swinglock 3y agoThe article omitted it, but the message says to update iOS to the latest software and enable its lockdown mode.
- Animats 3y agoRight. That's a "turn it off and turn it on again" tech support answer.
- jayrot 3y agoHardly. Keeping your apps and operating system updated is one of the more reliable prophylaxis against vulnerabilities. Unless I'm misunderstanding "turn it off and on again" suggest a kind of pointless, "just start over and try again" kind of suggestion, no?
- wolverine876 3y agoI disagree: I'd expect they would have discovered the exploit and delivered and update to patch it, and lock down mode is not standard usage by normal users.
- mardifoufs 3y agoHow can Pegasus and NSO still be allowed to exist? I know they are an Israeli corporation, but even then has there been action against them from the Israeli government? This is basically rogue state behavior
- r00fus 3y ago[flagged]
- EasyMark 3y ago[flagged]
- r00fus 3y agoYeah the issue with "Netanyahu is the problem" is that most of the Knesset is full of even worse folks. And the Israelis who elect them. The country is drunk with US money and arms and hasn't had to really consider rational approaches to anything since big daddy US always funds them regardless of their actions.
- TheGuyWhoCodes 3y agoThe only one stirring up a regional war is Iran, arming terrorist groups around Israel as a proxy war. The fact they can act with impunity is a stain on the west just like the war in Ukraine that still rages on. This might not have been a bin laden level assassination but it was not that far and any other country that faces the same threat would do the same.
- 616c 3y agoThere is always someone on each of N sides of these longstanding conflicts in the region saying "Y is really the problem (because I support X; all who support X know Y is the real problem)." That foreign powers abuse that to their own advantage worse than even the local factions do is the true stain on humanity. Why support this?
- 3y ago