4 ms·

Here's what it looks like: https://c.ndtvimg.com/2024-04/30p8264g_apple-notification_625x300_11_April_24.jpeg https://c.ndtvimg.com/2024-04/30p8264g_apple-notif

Here's what it looks like: https://c.ndtvimg.com/2024-04/30p8264g_apple-notification_625x300_11_April_24.jpeg https://c.ndtvimg.com/2024-04/30p8264g_apple-notification_62...

veeti 1y ago
> Apple detected a targeted mercenary spyware attack against your iPhone Not going to lie, this subject line would fit right in with the phishing messages and 419 scams in my Spam folder.
- internetter 1y ago
  Indeed, however the notification also comes via iMessage and appears at the top of your Apple account, plus contains no external links
  - aspenmayer 1y ago
    I wouldn’t be surprised if Apple’s malware notification comes via the same or similar mechanism as Apple 2FA codes on iOS, as iMessage itself is a common vector for these kinds of malware being warned of, such as Pegasus. Apple also notifies you of this kind of malware via the email used for your AppleID, in addition to on-device, though I wouldn’t be surprised if that same malware would attempt to monitor for these messages from Apple to prevent them from being received and/or read. The Apple Support app, for example, has capabilities which when triggered from the Apple side, allow screen-sharing and logging to be shared with Apple. I don’t know if this functionality relies on iMessage being enabled either, but I do know that the Apple Support app seemingly still works in Lockdown Mode. I’d be curious if the person in TFA had their device in Lockdown Mode, which supposedly is supposed to make these kinds of exploits harder to install. If they were using Lockdown Mode, and they still got exploited, that isn’t great news for the rest of us, but the fact that Apple notified them is better than the alternative of Apple not being aware of the breach and/or Apple being aware and not notifying them for reasons.
deleted 1y ago
[deleted]
hsbauauvhabzb 1y ago
An email? If they can breach your phone, surely email is the least trustworthy mechanism you can use - it’s high latency, shared across systems, etc A better mechanism would surely be a push notification to the device, or one of the alert-based notifications used for earthquakes etc
- saagarjha 1y ago
  A push notification that you receive…on the phone? There isn’t really a good solution here.
  - aspenmayer 1y ago
    Apple has the capability to remotely disable iPhones, which has been used when large numbers of iPhones were looted during riots in the US. I’m not sure if that capability relies on the devices not already being activated or not, but I’ve seen credible screenshots of the message when iPhones are so disabled. If I got a message in my iPhone saying it had been remotely disabled, I would take it to an Apple Store or authorized Apple Service Center, where they could tell me what should happen next. This would be inconvenient, to be sure, but it would be preferable to continuing to use the device.
  - hsbauauvhabzb 1y ago
    Well, it blocked the exploit. If the adversary knows the exploits blocked, their cover is burnt. What do they do? push notification + out of band comms would be more ideal, time sensitivity is significantly important.

Here's what it looks like: https://c.ndtvimg.com/2024-04/30p8264g_apple-notification_625x300_11_April_24.jpeg https://c.ndtvimg.com/2024-04/30p8264g_apple-notification_62...

veeti 1y ago

> Apple detected a targeted mercenary spyware attack against your iPhone Not going to lie, this subject line would fit right in with the phishing messages and 419 scams in my Spam folder.

internetter 1y ago
Indeed, however the notification also comes via iMessage and appears at the top of your Apple account, plus contains no external links
- aspenmayer 1y ago
  I wouldn’t be surprised if Apple’s malware notification comes via the same or similar mechanism as Apple 2FA codes on iOS, as iMessage itself is a common vector for these kinds of malware being warned of, such as Pegasus. Apple also notifies you of this kind of malware via the email used for your AppleID, in addition to on-device, though I wouldn’t be surprised if that same malware would attempt to monitor for these messages from Apple to prevent them from being received and/or read. The Apple Support app, for example, has capabilities which when triggered from the Apple side, allow screen-sharing and logging to be shared with Apple. I don’t know if this functionality relies on iMessage being enabled either, but I do know that the Apple Support app seemingly still works in Lockdown Mode. I’d be curious if the person in TFA had their device in Lockdown Mode, which supposedly is supposed to make these kinds of exploits harder to install. If they were using Lockdown Mode, and they still got exploited, that isn’t great news for the rest of us, but the fact that Apple notified them is better than the alternative of Apple not being aware of the breach and/or Apple being aware and not notifying them for reasons.

deleted 1y ago

[deleted]

hsbauauvhabzb 1y ago

An email? If they can breach your phone, surely email is the least trustworthy mechanism you can use - it’s high latency, shared across systems, etc A better mechanism would surely be a push notification to the device, or one of the alert-based notifications used for earthquakes etc

saagarjha 1y ago
A push notification that you receive…on the phone? There isn’t really a good solution here.
- aspenmayer 1y ago
  Apple has the capability to remotely disable iPhones, which has been used when large numbers of iPhones were looted during riots in the US. I’m not sure if that capability relies on the devices not already being activated or not, but I’ve seen credible screenshots of the message when iPhones are so disabled. If I got a message in my iPhone saying it had been remotely disabled, I would take it to an Apple Store or authorized Apple Service Center, where they could tell me what should happen next. This would be inconvenient, to be sure, but it would be preferable to continuing to use the device.
- hsbauauvhabzb 1y ago
  Well, it blocked the exploit. If the adversary knows the exploits blocked, their cover is burnt. What do they do? push notification + out of band comms would be more ideal, time sensitivity is significantly important.