Apple alerts exploit developer that his iPhone was targeted with gov spyware

https://techcrunch.com/2025/10/21/apple-alerts-exploit-developer-that-his-iphone-was-targeted-with-government-spyware/

by speckx • 9 months ago

290 144 9 months ago

You swim with sharks...

duxup8• 9 months ago

Gibson, who until recently built surveillance technologies for Western government hacking tools maker Trenchant, may be the first documented case of someone who builds exploits and spyware being themselves targeted with spyware.

Leopards ate my face moment?

They're not developing these tools to NOT use them...

alephnerd3• 9 months ago

Based on the article, it sounds like a bit of a "he said - she said" article after Gibson was terminated at Trenchant/L3Harris.

duxup8• 9 months ago

I'm not entirely sure how that applies to my post.

altairprime• 9 months ago

To clarify with the final paragraphs of context, “He said, Corp said, 3 of 3 coworkers asked corroborated what He said”.

tptacek10• 9 months ago

For at least 2 decades now exploit developers have been rather infamously prime targets for spyware, so whoever wrote this piece isn't read in at all to the industry.

ghostly_s• 9 months ago

Oddly it seems to echo the feelings of the spyware developer in question.

jsonBorn• 9 months ago

"..if you are a state or federal enforcement authority, and you have suspicion of any criminal activity of `Jay Gibson', be encouraged to immediately contact: Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram, Keybase and Wire @lorenzofb, or by email.

runjake2• 9 months ago

"Leopards ate my face" reference for others not in the know: https://knowyourmeme.com/memes/leopards-eating-peoples-faces...

throw0101c• 9 months ago

The original tweet just had its tenth anniversary (2015-10-16):

'I never thought leopards would eat MY face,' sobs woman who voted for the Leopards Eating People's Faces Party.

* https://twitter.com/Cavalorn/status/654934442549620736

CaptainOfCoit3• 9 months ago

What happened with "reap what one sows", did it go out of fashion? Seems the same.

ranger_danger4• 9 months ago

I went immediately to buy a new phone.

Why does he think that will help against a state-backed adversary?

perching_aix• 9 months ago

> I went immediately to buy a new phone.
Why does he think that will help against a state-backed adversary?

What are his alternatives?

ranger_danger4• 9 months ago

Not using a phone anymore

criddell• 9 months ago

Get a new iPhone and immediately turn on lockdown mode.

mrandish• 9 months ago

I'm not in this field but I was under the impression that people who know they are likely to be individually targeted use two (or more) phones and the one they use for their (target-worthy activity) is kept heavily locked down. Inconvenient to be sure but it seems like an unavoidable cost of being in that business.

duxup8• 9 months ago

I don't think he thinks it is a state.

ranger_danger4• 9 months ago

But the title says gov spyware?

bink5• 9 months ago

There is some amount of protection until the adversary discovers the new number. But since they've already compromised his phone they likely have his dad's number and can compromise that phone to find him again. It's dystopian.

If he's running iOS he can also enabled Lockdown Mode on the new phone to block most types of attacks.

fn-mote• 9 months ago

This doesn’t make sense… of course it will help. It gives you a clean slate, not compromised when you pick it up.

ranger_danger4• 9 months ago

Maybe but if we're talking on the level of targeted government surveillance, I think all options are on the table, i.e. they should assume they are being watched everywhere they go, and that all their communications, including their close friends/family (or anyone they have already been talking to lately) are likely being monitored as well, in which case, getting a new phone may not do much of anything.

Does that really not make sense?

ActorNightly3• 9 months ago

If there are zero click, unknown yet zero days against Apple devices, it won't help.

If you are actually security conscious, the only setup that works is have a public facing phone and a private phone that is custom rooted, de googled, and you control everything that runs on it.

rs186• 9 months ago

“I was panicking,” Jay Gibson, who asked that we don’t use his real name over fears of retaliation, told TechCrunch.

And later,

Without a full forensic analysis of Gibson’s phone ... it’s impossible to know why he was targeted or who targeted him.
But Gibson told TechCrunch that he believes the threat notification he received from Apple is connected to the circumstances of his departure from Trenchant ...

I find it funny that (1) this guy never thought this would happen to him (2) this guy has the balls to talk to media about this but fears retaliation

I mean, seriously, those who want to know your real name already know it.

ActorNightly3• 9 months ago

This honestly smells really strong like made up shit. Or the guy is very much a low key player.

Generally, if you develop exploits, you should be completely aware of every single possible attack vector. If you are working for a company like Trenchant, and you know what you are doing, the last thing you do is use Apple devices (at least fully, most of the time you have a public phone and much more secure private phone)

The reason is, when you take an Apple phone, connect it to a router that proxies through a computer so you can inspect traffic, you can see the vast amounts of shit being sent back to Apple which you have no control of.

Meanwhile, if you do the same with my custom rooted, de-googled android phone that I take overseas, you will see only ntp traffic, and that is only so I don't have to deal with cert issues because my clock is wrong.

saagarjha5• 9 months ago

Trenchant employees use iPhones just like everyone else. What else would they use?

ElevenLathe• 9 months ago

Going public is presumably part of his strategy for trying not to be disappeared.

asadm• 9 months ago

any guesses for the state here?

duxup8• 9 months ago

The article notes that the target's former employer makes hackng tools and they separated on bad terms. Seems like it easily could just be the target's former employer.

iamnothere2• 9 months ago

I would be more surprised if these employers didn’t target their employees to prevent leaks of trade secrets, union activity, or other internal dissent. Having the power would be too tempting to resist, and besides, there is some degree of legitimate concern; it would be easy enough for rogue employees to sell exploits on the side for millions (there are plenty of buyers).

Another reason not to work at places like this.

arthurcolle• 9 months ago

I'm going to go out on a limb here and say it's a state in the DMV.. L3Harris HQ is in Arlington if I'm not mistaken

tptacek10• 9 months ago

If it's actually a state, it's unlikely to be a NATO or FVEY country, since L3Harris is one of the largest defense contractors in the world and most of those countries are customers. The piece is kind of all over the place but the vibe it lands on is that his work phone may have been owned up by his employers.

zzrrt• 9 months ago

his work phone may have been owned up by his employers

First line says "personal phone". I presume MDM on a work phone could do most of the things they'd be interested in, without the risk of setting off an alarm like this. Anyone have speculation about a reason for an employer to pwn a phone that's already on their MDM?

KoftaBob• 9 months ago

When it comes to state-sponsored cyber-spying like this, take your pick between USA, Israel, Russia, China.

amelius• 9 months ago

Maybe it went like this:

- Exploit developer makes and plays with exploits on their phone

- Apple notices this, warns them that there is spyware on their phone

- Exploit developer somehow thinks it is governments hacking into their phone

saagarjha5• 9 months ago

These exploits get developed on airgapped devices

freehorse2• 9 months ago

I have mixed feelings of how pathetic this is, and then extreme fear because once things hit this level, you never know what’s going to happen

Interesting kind of payback. What does he think happens to the people whom the exploits he develops target?

thesuitonym• 9 months ago

Sounds like he naively believes only governments use these, and only against legitimate criminals.

markus_zhang2• 9 months ago

What is the surprise? If I'm in his shoe I'd expect the gov knows everything about me including how often I make sex.

jeffhuys• 9 months ago

Nullable column I guess?

I’m kidding of course

markus_zhang2• 9 months ago

0 is not NULL!

bink5• 9 months ago

I've interviewed with these types of companies (not the ones in the article). I've even caught them using their exploits on me after they made me an offer and that seems to be the most likely explanation for what happened here. I don't know how anyone can develop exploits for resale in good conscience.

If these companies have no qualms using their exploits against their own employees they'll have absolutely no problem using them against members of Congress, the Courts, investment banks, tech leaders, and anyone with any sort of power. This gives them the ability to blackmail some of the most powerful people in the world.

edit: And that's not even mentioning their reported "intended use" against dissidents and journalists.

Ms-J3• 9 months ago

That's outrageous that they tried to attack you like that. How exactly did it happen? Did they send a link via SMS to your phone, or some other way?

bink5• 9 months ago

I don't wanna give away too much in case they're reading, but they didn't use their stealthiest exploit. It was pretty obvious, especially if you monitor your network traffic.

tptacek10• 9 months ago

You don't know how any of these could be developed in good conscience? How about: anti-proliferation intelligence work is going to happen whether it requires human intelligence or CNE, and CNE is less costly and harmful?

I get where you're probably coming from: this same technology is used all over the world to target journalists and dissidents in countries with and without the rule of law. A very real concern. I wouldn't do this kind of work either (also, it's been over a decade since I had the chops even to apprentice at it).

But there are very coherent reasons people are comfortable doing this work for NATO countries. Our reflexive distrust of law enforcement and intelligence work is a fringe belief: a lot of families are very proud to include people working in these fields.

The most important thing I guess I'd have to say here is: our opinion of this stuff doesn't matter. At current market rates every country in the world can afford CNE technology, and it's a market well served by vendors outside of NATO.

Ms-J3• 9 months ago

"our opinion of this stuff doesn't matter."

It very much does matter. If more people refuse to do this type of work, it eventually won't be done to the required standard. People would cut family ties and this would stop fast.

bigyabai• 9 months ago

At current market rates every country in the world can afford CNE technology

Slippery slopes don't justify anything. You might not care enough to make a difference, but many people do and your justification rings hollow to everyone that's potentially a victim. You wouldn't say this about nuclear proliferation, so why make a carveout for digital mercenary work? Because it's "harmless"?

I don't know what your goal is with this statement but it certainly doesn't make me feel any better. If you're this emotionally invested in the topic, it might be best for your own optics to not chime in.

sakisv• 9 months ago

I think I agree with what I think you're trying to say.

However I don't agree with the repercussions of this, which are the same ones that make all reasonable people, security experts included, oppose EU's ChatControl or the UK's backdoor requests: There is no way to ensure and protect the people that need protection, as there is no way to ensure that only "the good guys" have it.

We tend to bullshit ourselves into believing that because spyware software like Predator are weapons, meaning that only countries would be allowed to buy them and use them (same way that Jeff Bezos cannot buy and use an F-35 for example). We see though, that certain individuals _can_ get their hands on these things and use them however they want.

For example, 3 years ago someone adjacent to the greek government bought and used Predator against MEPs, journalists, army generals, mafia bosses, MPs of opposing parties and even MPs of their own, ruling, party. The greek government of course denied that they did it, and they said that this individual did not act under the instructions of the government (though they then changed the law to prevent anyone for learning details about it, but that's a different story).

So, apart from adopting the same approach as with ChatControl and encryption backdoors, i.e. banning them, I don't know how we could protect ourselves against them.

1659447091• 9 months ago

You don't know how any of these could be developed in good conscience?

The OP did say "...for resale in good conscience."

I personally read that as the commercial companies that allows anyone to buy the product off the shelf for the right price -- including governments, but also rogue elements. Bad actors, groups, or even people engaged in abusive domestic practices (customers without the time, experience, or resources to do it in-house). Not the people who work directly under government agencies developing these things for State level intelligence/ops

1oooqooq• 9 months ago

humans create myths which shape their world.

you, sadly, internalized a state humanity adopted after wwii, were the anti red propaganda told everyone that of you could illegally burn a forest down to then buy a Ferrari, it was the best course of action because if you didn't do it, someone would.

thankfully people like you are being ostracized, albeit too slow, and pointed out as what you really are: agentless weak oportunists.

duxup8• 9 months ago

I think by default these companies kinda filter out people with values that would impede unrestricted use of their tools. And at worse possibly attract people who think "I'd sure like to spy on other people". That's scary.

gessha• 9 months ago

That or they mask their activity with layers of management and vague and abstract products.

saagarjha5• 9 months ago

Maybe that was just a phase of your interview.

neilv• 9 months ago

I figured security researchers were always targets of multiple APT actors and random individuals. However...

I've even caught them using their exploits on me after they made me an offer

Not only for exploit companies that eat their own dog food, nor only cybersecurity jobs, but I've heard of this happening to people interviewing for other tech area considered strategic.

The noticed ones weren't that subtle, and were presumably noticed because the attacker wasn't using the best methods, but maybe more routine SOP for lower-value targets.

I have no idea what the actors and motivations actually were. Speculation:

* the hiring company or its country, vetting the candidate by spying on them, including for corporate/national counterintelligence reasons (it's really not much different than a lot of the sneaky surveillance capitalism vetting that many companies quietly do, just unambiguously illegal in this case);

* the hiring company, spying to monitor the competitive offer situation (e.g., what counteroffers or concerns does the candidate have);

* other state, individual, and possibly corporate actors, for whom the imminent offer flagged the target as worth keeping an eye on (for, e.g., advance access to research they do individually, knowledge of attacks they do individually, possible technical entry point to the job-offering organization or others, or kompromat for getting access/actions); or

* random associated individuals acting on their own, recreationally enjoying the power over others that their cracking toys give them (which at least used to be not too uncommon, before cybersecurity was professionalized, when there were proportionally much more teens and alienated people, and they hadn't yet been told about color-coded hats for prefabricated codes of behavior from which they could choose; now, most people with skillz have the carrot of a lucrative job or respected status as researcher that they can pursue, instead of seeking power/status other ways and without guidelines).

Personally, I try not to work on strategic target areas, since I like to save my very limited guts for fighting product concepts and reliable systems into shape, not for being helplessly violated by lawless authoritarian institutions. Good luck.

jokoon2• 9 months ago

This is why I don't want to work in cybersecurity

This is too dangerous, it's the wild west

hopelite3• 9 months ago

Forget blackmail, people wildly overestimate the value of blackmail. Far more predictable and lucrative is just to use exploits for insider information, including as favors and bribes, and selling them to governments willing to pay immense amounts of money. Blackmail is far too messy. Grease works way better.

throwaway484763• 9 months ago

Plata o plomo. Usually a combination of threats and bribery is most effective. The truly dangerous groups usually have the ability and willingness to pay well.

octoberfranklin• 9 months ago

Forget blackmail

Tell that to Epstein.

yachad• 9 months ago

Live by the sword, die by the sword.

antonymoose• 9 months ago

If an engineer at Ford dies in a car crash does he really deserve it?

We live in a world full of threat-actors. We need exploits just like we need firearms and tanks and fighters and jets.

To mock the guy is just naive.

kuhsaft3• 9 months ago

An engineer at Ford isn’t developing cars that actively harms passengers.

If you develop weapons, physical or digital, don’t be surprised if you end up on the receiving end.

lawlessone• 9 months ago

Not the best analogy, more like a man who develops car mounted harpoons being hit by a car mounted harpoon.

tptacek10• 9 months ago

I know people involved at Trenchant and have trouble believing that anybody who worked there was shocked by this threat. Maybe things have changed post-L3Harris but "it" (it's more than one company) was an incredibly paranoid IT shop prior to the acquisition.

commandersaki3• 9 months ago

I read this article with a healthy amount of scepticism and read two separate stories:

1. This guy was targeted by spyware.

2. This guy was an iOS 0-day exploit developer and is involved with a bit of drama with his previous employer.

Everyone seems eager (including himself) on connecting the two, but why would the ex-employer go after him using illegal methods when they've agreed to a settlement and termination? Unless there's more to the story (which I strongly doubt) it seems to be combined mix of legitimate but misplaced paranoia and lashing out.

r_lee• 9 months ago

This guy is pretty naive if he thinks they (or their biggest customers) won't verify whether he really was leaking something or not if they've got the tools to do that lol and to maybe send a message to not think about it

CaptainOfCoit3• 9 months ago

Gibson .. may be the first documented case of someone who builds exploits and spyware being themselves targeted with spyware.
But the ex-Trenchant employee may not be the only exploit developer targeted with spyware .. there have been other spyware and exploit developers in the last few months

eimrine• 9 months ago

I would like to see the screenshot or the photo of display with that kind of alert.

runjake2• 9 months ago

Here's what it looks like: https://c.ndtvimg.com/2024-04/30p8264g_apple-notification_62...

veeti• 9 months ago

Apple detected a targeted mercenary spyware attack against your iPhone

Not going to lie, this subject line would fit right in with the phishing messages and 419 scams in my Spam folder.

hsbauauvhabzb4• 9 months ago

An email? If they can breach your phone, surely email is the least trustworthy mechanism you can use - it’s high latency, shared across systems, etc

A better mechanism would surely be a push notification to the device, or one of the alert-based notifications used for earthquakes etc

ajross2• 9 months ago

This framing seems weird:

Two days after receiving the Apple threat notification, Gibson contacted a forensic expert with extensive experience investigating spyware attacks.

Surely as a professional "exploit developer", Gibson himself should have been about as expert at this particular niche as any human being on the planet already.

I mean, sure, absolutely he should have called in his friends in the community and gotten more eyes on the device. But the way that's written it sounds like he took it into the local Genius Bar.

It also, in context, feels a little obfuscatory. Like he's trying to flag the involvement of senior folks who he can't name.

tptacek10• 9 months ago

I agree it reads weird, but I am leaving room for the idea that there are a lot of very gifted people who work on this stuff as an intellectual challenge, have a sort of straight up systemsy computer science background, and don't have or care about a bigger picture of where they fit into the industry. But still: the companies that became Trenchant were notoriously paranoid about state-sponsored CNE threats! It would still be weird to be surprised by them.

felsokning• 9 months ago

I think you're conflating two precepts. Just because you can write an exploit, it doesn't - inherently - mean that you have the skills/knowledge/tools of where to look for all signs of exploit having occurred on your device(s).

From the inference of that logic, every developer should be able to use gdb or Windbg to ascertain where they shot themselves in the foot - but we know that this specific set of skills isn't inherently required to be a developer.

So, the same logic would be true here: Just because you can write a hand full of exploits, it doesn't inherently mean that you have the tools/know-how to be able to ascertain if any of all of the available exploits in the wild (or in private, re: tools for Trenchat) have been used on your phone.

Edit: gbd != gdb

ajross2• 9 months ago

You're arguing at the wrong side of the problem. Obviously yes, everyone can't be a perfect expert on everything and when doing anything complicated you should ask for help. Duh, as it were. I think I even said as much.

The point was at this level of expertise and size of market ("detection of iOS zero day rootkits"), there simply isn't a pool of "experts" you can draw on to do this a-la contract work. It's a tiny world and everyone is fumbling around and asking for help independently. And as a member of that tiny world, Gibson surely knew who he needed to call already.

But that's not the way the article framed the interaction, which implies to me that there's more context at work here.

2OEH8eoCRo0• 9 months ago

Why is it not computer crime? It wasn't done by the govt, they suspect it was done clandestinely by Trenchant.

Sue them!

kuhsaft3• 9 months ago

There's still no proof that it was Trenchant, and there was no evidence on the device. It's unlikely that it will ever be identified as an attack from Trenchant. Trenchant/L3Harris is a supplier for Five Eyes, and any attribution of their exploits will likely be concealed.

ta12432• 9 months ago

Normally with crime we arrest people. Half the problems in the world seem to stem from the fact companies are unaccountable.

stego-tech• 9 months ago

I can kinda sympathize with the guy, as I got fucked over in Defense contracting in a not-dissimilar fashion a lifetime ago. These companies reel you in with decently-sized (or even outrageously-large) pay packages and promises of doing “good work”, bleed you of your energy and time for their profits, then shove you out the door and blame you for anything that went wrong (especially if you try to act honestly and report wrongdoing - that’s a one-way ticket out the fucking door and into blackball territory).

Nobody should be doing work for these scumbags, but people will always fall for their spiels and grifts, unfortunately, out of some naive sense of “doing good” or “getting the bad guys”. It’s always just “leopards ate my face”, though.

spelk• 9 months ago

Enlist and get your top secret clearance managing LANs and teaching officers how to add images into PowerPoints, they said. You’ll never be unemployed. Then you realize the “job” mostly involves being a disposable cog in some ex-colonel’s endless PowerPoint war. Every meeting feels like a high-stakes reenactment of “Yes, sir,” where accountability is optional and speaking up is career suicide. Billion-dollar mistakes are brushed off as “lessons learned,” while you get a lecture about integrity. It’s the world’s most expensive game of “the emperor has no clothes,” except everyone’s wearing lanyards and classified guilt.

midtake• 9 months ago

I'm more interested in how Apple makes this determination than I am about the drama between this dev and his former employer.

rekttrader3• 9 months ago

His former employer sandbox over wifi or use stingray like devices. Apple can see that this went over the public iMessage/PushNotification channels.

flux3125• 9 months ago

“I was panicking,” Jay Gibson, who asked that we don’t use his real name over fears of retaliation, told TechCrunch.

I lol'd for a second imagining this is his actual name but the writer didn't realise it

jokoon2• 9 months ago

This is why I don't want to work in cybersecurity

This is too dangerous, it's the wild west

justinclift• 9 months ago

So basically it was probably someone in his chain of command leaking the Chrome exploits, and this guy was the scapegoat used to cover that up for now.

Though the whole thing sounds more made up than legit.

kstrauser• 9 months ago

I had to read "Apple alerts exploit developer" several times to understand what it meant.

First read: "Apple's alerts somehow exploit a developer".

nth read: "Apple's alerts tell a developer of exploits that..."

seba_dos1• 9 months ago

So Apple told them of exploits? :)

rekttrader3• 9 months ago

As a former researcher in this space, anyone who develops commercial exploits knows what they are doing and that their work if they happen to be in the US is subject to ITAR level restrictions.

I stopped when it became a game at that level. I refuse to be a government contractor…. It’s about not using software like this to kill people like Jamal Khashoggi.

F the dipshits at NSO and the turds at Corellium.

Apple alerts exploit developer that his iPhone was targeted with gov spyware

Related Stories