“Clickless” iOS exploits infect Kaspersky iPhones with never-before-seen malware

https://arstechnica.com/information-technology/2023/06/clickless-ios-exploits-infect-kaspersky-iphones-with-never-before-seen-malware/

by samizdis • 3 years ago

116 41 3 years ago

arstechnica.com

open-paren• 3 years ago

https://securelist.com/operation-triangulation/109842/

gnicholas4• 3 years ago

Would this be prevented if an iPhone were in Lockdown Mode? [1]

1: https://support.apple.com/en-us/HT212650

lcampbell• 3 years ago

Given the exploit vector looks like yet another iMessage attachment bug,

The target iOS device receives a message via the iMessage service, with an attachment containing an exploit.

and that one of the effects of Lockdown Mode is

Messages - Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable.

It might be prevented. Pretty sure disabling iMessage altogether sidesteps this class of bugs too. I've lost track of how many times iMessage has been the root cause of "unattended iOS RCE," at this point it's almost user negligence to have left on.

gnicholas4• 3 years ago

I was surprised that the article didn't mention Lockdown Mode considering the likely overlap in features. It's even possible that Lockdown Mode was developed (at least in part) to defeat these types of exploits, given the timeline.

hospitalJail2• 3 years ago

Apple has chosen that it is more important to exploit in-group bias with bubble colors than phone security.

I joke, but I can't tell you how annoying iMessage has been. Its so bad with non-iphones, we basically switch to email or teams when doing group communication.

miohtama• 3 years ago

Likely another C-based media codec or other similar legacy file reader bug.

metadat• 3 years ago

Is there a way to disable only the iMessage attachments functionality? (as an alternative to going full lockdown)

jmah• 3 years ago

Lockdown Mode was added in iOS 16. The article only mentions iOS 15.7, saying there is no information whether iOS 16 is vulnerable (with or without Lockdown Mode), unfortunately.

It's curious they say iOS 16 was released "last month" when it was released last year.

game_the0ry2• 3 years ago

Non-click exploits are freaky. I wish there was a way to detect if my device is compromised.

hospitalJail2• 3 years ago

Treat all of your devices as compromised. Between the FBI breaking the terrorist's iphone, Pegasus, etc... It might be best to have a burner smart phone that you keep off 99.99% of the time and get your secrets off it only.

boringuser2• 3 years ago

Or, you could just not have an iphone.

m463• 3 years ago

Blame apple for this.

I've always said you should be able to see what's on your own device, but apple doesn't allow it, you can't access the entire filesystem.

Also you can't see what processes are running, what they are doing, or look at the network traffic being generated.

saagarjha2• 3 years ago

It's not particularly convenient but iOS does provide ways to fetch a list of running processes for debugging purposes.

mensetmanusman• 3 years ago

I curiously look forward to a self-propagating worm that bricks all iphones with a zero click bug.

It will be a fascinating day in human history.

samspenc• 3 years ago

My first question upon seeing the title was "What are Kaspersky iPhones?"

Answered in the first paragraph: "Kaspersky has been hit by an advanced cyberattack that used clickless exploits to infect the iPhones of several dozen employees with malware ..."

So this was iPhones belonging to Kaspersky employees - though sounds like the exploit could hit any iPhone.

amuletgrey• 3 years ago

Looks like kaspersky just tries to blame iphones.

pseudo0• 3 years ago

the fact of infection was detected by Kaspersky Unified Monitoring and Analysis Platform (KUMA), a native SIEM solution for information and event management; the system detected an anomaly in our network coming from Apple devices.

Interesting. This demonstrates the big downside of iOS's security model - it's basically impossible to run useful host-based IDS, which likely would have flagged this much more quickly.

ikekkdcjkfke2• 3 years ago

What an absolute joke that you can upload files on demand to someones phone as long as you have a number or an email

TazeTSchnitzel2• 3 years ago

What is email if not a way to send files to other people's computers? I don't understand your point.

jdm22122• 3 years ago

Gmail is not my computer.

ikekkdcjkfke2• 3 years ago

Same case with email too. I prefer to access email through a browser where you have a little more control over what gets loaded. Atleast then it's above a clickless.

killingtime74• 3 years ago

Interesting that people in sensitive positions would use foreign made smartphones. Surely they are Russian companies that manufacture at least low end Android phones?

theaudacityofyw• 3 years ago

Android would still be running Google so I guess it's a risk either way. At least Apple seem to be more secure by default without any user config.

Looked this up and there is indeed a Russian company called Ayya, making smartphones with a switch to disable the microphone. It'll also be changing from Android to a domestically made OS, it seems. https://www.indiatimes.com/technology/news/russia-ayya-t1-sm...

malermeister• 3 years ago

Doesn't need to be a Google version of Android. Since it's open source, there's plenty of non-Google forks, such as this one, focusing on privacy and security: https://grapheneos.org/

stonepresto• 3 years ago

I assume the norm, or at least what they want to be the norm, is Huawei, Oppo, or Xiaomi. Regardless of what manufacturer or OS you use, it will not protect you from motivated nation states or companies like NSO.

If you are truly concerned for your life, especially in authoritarian regimes, don't carry a phone.

enkid• 3 years ago

This was delivered by a remote exploit, not a supply chain issue. How would buying a domestically produced phone prevent this?

kop316• 3 years ago

There's an entire section in the article titled: "Russia accuses Apple of colluding with the NSA". I would assume if the FSB isn't just blowing smoke, then your question is answered.

user6723• 3 years ago

This is why on our GrapheneOS devices we use a messenger that is written in Rust.

“Clickless” iOS exploits infect Kaspersky iPhones with never-before-seen malware

Related Stories