Possible US Government iPhone-Hacking Toolkit in foreign spy and criminal hands

https://www.wired.com/story/coruna-iphone-hacking-toolkit-us-government/

by alwillis • 5 months ago

240 86 5 months ago

mentalgear• 5 months ago

How could something as sensitive get out of an administration as competent as the current one? At least they have no access to lets say AI or autonomous weapons and the tools of mass surveillance ...

happyopossum• 5 months ago

"Possible" stripped from the headline on HN. That word seems particularly important given that it's speculative:

"Clues suggest it was originally built for the US government."

tptacek5• 5 months ago

The Google threat analysis report doesn't say anything about USG involvement; that it was found on compromised Ukrainian sites, has code written in "native English", but also signs of LLM authorship. The Google report says the kit they found can't compromise current iOS, which is a capability you'd assume USG would have --- though it's important remember that "USG" comprises dozens of different buyers each with different toolchains.

Maybe this was the Fisheries Department exploit toolkit.

iVerify, which spun out of Trail of Bits and presumably knows what they're talking about, says it bears "hallmarks" of being connected to USG CNE work. I believe it. But the USG is on net a buyer, not a producer, of CNE tooling. Whatever a given service agency or IC arm buys, dozens of other aligned countries are also buying.

(And, of course, the non-aligned countries have their own commercial supply chains).

bri3d• 5 months ago

I don't think the ancient nature of the exploit chain has much bearing on the origin. I think it points away from the actual 2025 campaigns being USG-attached, but I don't think anyone was suggesting that to start with - the Google report makes it pretty clear that they believe the same code was resold to several parties, either in parallel or sequentially, around this time frame.

I think the notion here is that either:

* There's a shared upstream origin or author between this toolkit and the Operation Triangulation toolkit ahead of the use in Operation Triangulation (ie - someone sold this chain to both the Operation Triangulation authors and a third party). I actually think that the uses of specifically structured code-names internally and the overall structure of the codebase described in the Google writeup make this theory less likely; building an exploit toolkit while using these practices to cosplay as a US-government affiliated engineer would be clever and fun, but it's not something we've really seen before.

* This toolkit originated from (whether it was leaked, compromised, or resold) the same actor who was responsible for Operation Triangulation.

tennex• 5 months ago

Maybe this was the Fisheries Department exploit toolkit.

buried lede, but hilarious

Simulacra• 5 months ago

Good point, that was also struck by the comment that it's infected "tens of thousands" phones. That's a minuscule rounding error.

dang3• 5 months ago

The title limit is 80 chars, if anyone wants to figure out a decent way to squeeze possibility back in there.

alwa• 5 months ago

“Possible US-Gov-made iPhone-hacking toolkit is now in foreign and criminal hands“ ?

irishcoffee2• 5 months ago

A US Govt iPhone-hacking suite is now possibly in criminal hands

15 chars to spare!

doctorpangloss2• 5 months ago

the government doesn't have superpowerful code crackers though

it has a guy working at apple who introduces the subtle vulnerability he is instructed to do

tptacek5• 5 months ago

I expect the evidence for this claim is axiomatic, which is to say that you think it sounds good.

lightedman• 5 months ago

No, anyone who remembers the Best Buy/FBI debacle knows that this statement is very well-grounded in reality. If you took your laptop to Best Buy for repairs, the FBI got a copy of your hard drive contents.

doctorpangloss2• 5 months ago

haha yeah, thanks for the compliment

joshrw• 5 months ago

Hello, have you heard of the Snowden revelations? What OP was referring to are called bugdoors.

bigyabai• 5 months ago

You should expect more, unless you have evidence that conclusively discredits the claim.

thesuitonym2• 5 months ago

Those two are not mutually exclusive.

8cvor6j844qw_d6• 5 months ago

Yeah. TAO was intercepting Cisco routers in transit and installing implants.

The leap from supply chain interdiction to cooperative insiders isn't a big one.

hulitu2• 5 months ago

Cisco routers

famously known for their backdoors.

everdrive• 5 months ago

No matter the risk, I must carry my smartphone everywhere and install every app. It would be unimaginable to have the urge to look something up, but then wait to do it later until I'm using a real computer. No negative outcome will EVER shake my deep, permanent need to carry a smartphone all the time and use it for as much as possible.

theearling2• 5 months ago

Webapps exist for a reason, they don't get all the special permissions apps get when fully installed.

at the very least use a VPN / more secure phone like a pixel with graphene

You keep doing you though

thewebguyd• 5 months ago

Ironically, the exploits in this leaked kit all involved flaws in webkit, so you'd have been safer sticking to native apps assuming they didn't have any webviews in them to load the malicious site.

thesuitonym2• 5 months ago

A VPN won't help you if your device is compromised. A VPN won't help you if the server is compromised. A VPN won't help you if the VPN is compromised.

I really wish people would understand that VPNs are not magical, unbreakable security. VPNs are barely security at all, and commercial VPNs even less so.

diacritical2• 5 months ago

You forgot the urge we all share to store all our login information on our phone, to exclusively use it for banking, to take and store all our sensitive photos and videos, to exclusively use it for any kind of communication, to keep the microphone and camera intact and to leave our phone on 24/7 next to us.

Seriously, what's the worst that could happen with an internet connected closed down device that holds all our information and has a microphone and camera? People must be just paranoid.

stock_toaster• 5 months ago

With this administration? Color me unsurprised.

auslegung• 5 months ago

In total, Coruna takes advantage of 23 distinct vulnerabilities in iOS, a rare collection of hacking components that suggests it was created by a well-resourced, likely state-sponsored group of hackers.

People have been hacking iOS since before it was called iOS and they weren't necessarily "well-resourced, likely state-sponsored". See geohot

__del__• 5 months ago

im[ns]ho, people want desperately to believe that only state funded actors can possess that kind of power.

tptacek5• 5 months ago

Point taken, but in fairness, it has gotten way more expensive. This isn't the platform Geohot jailbroke anymore.

jesse_dot_id• 5 months ago

It seems as though you can basically do anything in this administration if the money is right, so selling state secrets free of punishment sounds about right to me.

butILoveLife2• 5 months ago

Hierarchies can punish this. Note that the legislature and judicial branches exert their power. Epstein files got released if you need proof.

(However, if we are International Systems Realists, there are inevitable effects that happen. I have a feeling even Biden/Harris would be in Iran right now.)

dlev_pika2• 5 months ago

Some got released, and in the way the Executive wanted them to be.

This proves the opposite IMO - while the Legislative is co-opted, the Judicial branch has shown it is quite inadequate exerting control or punishment of the Executive.

alwillis7• 5 months ago

I have a feeling even Biden/Harris would be in Iran right now.

I seriously doubt that; certainly not under the current circumstances of rising inflation with negative economic growth.

King-Aaron2• 5 months ago

The rule of law does appear to be dead, instead it's a protection racket system in the US these days.

AngryData2• 5 months ago

It has been for decades now, they are just open and blatant now because the corruption is so deep rooted that there is little average people can do except choose to burn down the house around themselves.

grehbies• 5 months ago

To me, it's just another example of what the poor and marginalized in this country have known for generations, finally catching up to the comfortable class. It's easier to count the institutions that AREN'T pay-to-play, especially those associated with the law and courts.

Know what's fun? Facing down a trained attorney as a pro se litigant in small claims court. Want to beat the 70-90% loss rate for pro se litigants in a forum that was originally designed specifically for pro se litigants? Hire a lawyer, lol.

Small claims, true to the name, is the lowest of low stakes. It's downhill from there.

kgwxd• 5 months ago

You can get it for free if you have the right blackmail material.

stronglikedan• 5 months ago

this administration

and the one before it, and the one before that, and the one before that, and so on. that's politics and there is nothing new under the sun

alwillis7• 5 months ago

There are things that have never happened before in the 250 year history of the United States.

No sitting president has ever enriched themselves by billions of dollars.

We’re in a completely different universe from the days when Jimmy Carter put his peanut farm in a blind trust so there would be no appearance of a conflict of interest.

Or when Lincoln was given some gifts from the King of Siam. Because of the Emoluments Clause in the Constitution, he went to Congress to check if he could keep them. Congress said no; Lincoln donated them.

It was understood a president could be prosecuted if he broke the law—that’s why Nixon needed to be pardoned by Ford; otherwise, he would have faced at least some consequences.

SCOTUS did a 180 degree turn by ruling a precedent is immune from prosecution for crimes committed in office.

SCOTUS just made that up out of thin air.

All of this and much more is unprecedented.

Last one: no president has ever gone to war without making a case for it to the country.

So no, what’s happening now is not the same old thing.

harambae• 5 months ago

“These zero-day and exploit brokers tend to be unscrupulous," says Cole. “They sell to the highest bidder and they double dip. Many don’t have exclusivity arrangements. That’s very likely what happened here.”

I interpreted this a different way - that a shady supplier to the US Government double dipped to the other side.

butILoveLife2• 5 months ago

Meanwhile last time I checked, Android bug bounty is higher.

iPhone makes you an easy target. Sorry Besos, security through obscurity was a bad idea... but you should have known better.

cluckindan• 5 months ago

Sorry who?

dlev_pika2• 5 months ago

Binders with classified information were hosted in a bathroom at a country club, so…you know…

varispeed3• 5 months ago

Whenever I point out that Apple's "security by obscurity" strategy is a complete failure I get downvotes.

Person suspecting their iPhone has been hacked has no way to check it. Apple only offer cope mechanism in form of "lockdown mode", which likely can be bypassed just as well.

This situation shows that Apple devices are not secure and liability.

They'll likely protect your grandma from getting low effort malware, but if you are a CEO - buy something else.

tptacek5• 5 months ago

What do you mean by "security by obscurity"? What's your comparand that doesn't have the same software defects iPhone-targeting CNE is exploiting?

varispeed3• 5 months ago

One for instance is that Apple doesn't offer an API for deep system scanning. So if your phone is infected, you have no way of knowing this, because there is no software that can scan it. You cannot trust it.

Or things like Memory Tagging Extension (MTE) Apple has implemented, but they have not released specification and implementation details, so you don't know if it has backdoors.

mikestew• 5 months ago

Whenever I point out that Apple's "security by obscurity" strategy is a complete failure I get downvotes.

Maybe because you apparently don’t know what “security by obscurity” means? Regardless, what’s your recommendation for “buy something else”?

alwillis7• 5 months ago

A person suspecting their iPhone has been hacked has no way to check it. Apple only offers a cope mechanism in the form of "lockdown mode", which likely can be bypassed just as well.

In the past, Apple alerted users (journalists, political activists, dissidents) when a "state-level actor" attempted to hack their iPhones [1].

Apparently, the FBI couldn't get past Lockdown Mode: FBI stymied by Apple’s Lockdown Mode after seizing journalist’s iPhone [2]"

And don't forget about Memory Integrity Enforcement (MIE) that debuted on iPhone 17 and iPhone Air [3]:

MIE is described as the industry's first always-on, comprehensive memory safety protection, built on the Enhanced Memory Tagging Extension (EMTE) in synchronous mode, combined with secure typed allocators and tag confidentiality protections.

[1] https://www.sentinelone.com/blog/so-state-sponsored-attacker...

[2] https://arstechnica.com/tech-policy/2026/02/fbi-stymied-by-a...

[3] https://security.apple.com/blog/memory-integrity-enforcement

varispeed3• 5 months ago

Yes, Apple controls who gets alerted about security breach. This means not everyone with compromised phone will get alerted. You are still in the dark.

Maybe they could maybe they couldn't, doesn't mean criminals couldn't.

MIE is opaque - Apple has not disclosed its design - it also means it can contain intentional backdoors and other security holes.

In other words this is just meaningless PR and doesn't change the fact that Apple's security is poor.

shell0x• 5 months ago

Trump ruined America's reputation forever imho.

He keeps changing his mind every day and keeps talking bullshit. At this point the trashy drug dealer trying to sell to school kids is more reputable than the USA

mindslight3• 5 months ago

No, Trump did not ruin America's reputation. No matter how many billions he steals, how many kids he rapes, how many Americans his terror squads execute, one man cannot ruin America's reputation. What has ruined America's reputation is all of the people continuing to support and enable this sick man - from the politicians and surveillance industry titans who are in on the con, to the grassroots supporters who won't set aside their (understandable!) grievances and would rather see our country destroyed. That is who has ruined America's reputation.

aa-jv3• 5 months ago

Americas reputation was ruined by decades of war crimes, crimes against humanity, and violations of human rights at massive scales - and the American peoples' utter inability to reign in their own very, very real war criminals. Trump is just one in a long, long line of American war criminals who should long ago have faced justice in The Hague.

Americans can't understand this because Americans hate being embarrassed by their states' misdeeds, but its very real. The rest of the world sees the crimes, even if American's are too cowardly to also do so ..

markus_zhang• 5 months ago

    Many components of Coruna have never been seen before, he points out, and the whole toolkit appears to have been created by a “single author,” as he puts it.

I wonder who wrote it. Must be someone really good at it. Someone who might never give a talk in a conference.

simulator5g• 5 months ago

“The Coruna Virus”. Nice.

testaburger2• 5 months ago

does tahoe 26.3 protect against this?

LastMuel• 5 months ago

Google notes that Apple patched vulnerabilities used by Coruna in the latest versions of its mobile operating system, iOS 26, so its exploitation techniques are only confirmed to work against iOS 13 through 17.2.1.

testaburger2• 5 months ago

thanks! sorry I meant to say IOS 26.3

alwillis7• 5 months ago

does tahoe 26.3 protect against this?

Apparently if you have Lockdown mode enabled, then yes.

Obscurity4340• 5 months ago

Google also notes that Coruna checks if an iOS devices has Apple's most stringent security setting, known as Lockdown Mode, enabled, and doesn’t attempt to hack it if so.

nameconflicts• 5 months ago

So, under which government was this hacking toolkit developed?

Kiboneu• 5 months ago

Google also notes that Coruna checks if an iOS devices has Apple's most stringent security setting, known as Lockdown Mode, enabled, and doesn’t attempt to hack it if so.

hulitu2• 5 months ago

US Government iPhone-Hacking Toolkit in foreign spy and criminal hands

Why repeat yourself ? (US Government, criminal hands)

Possible US Government iPhone-Hacking Toolkit in foreign spy and criminal hands

Related Stories