Google Outlines iPhone Vulnerabilities That Let Malicious Websites Steal User Data for Years, Now Fixed

Google's Project Zero published a blog post this week about a previous security threat wherein malicious websites quietly hacked into the victim's iPhone. This small collection of hacked websites were used in what was described as "indiscriminate" attacks against unsuspecting visitors for years, but the threat has been addressed by Apple.


If the attacks were successful, a monitoring implant would be installed on the targeted ‌iPhone‌, able to steal private data including messages, photos, and GPS location in real time. Google estimated that thousands of visitors headed to these websites per week over the course of two years, and that iOS versions ranging from iOS 10 to iOS 12 were exploited.

There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant. We estimate that these sites receive thousands of visitors per week.

TAG was able to collect five separate, complete and unique ‌iPhone‌ exploit chains, covering almost every version from iOS 10 through to the latest version of iOS 12. This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years.

Project Zero discovered exploits for a total of 14 vulnerabilities in iOS, seven for Safari, five for the kernel, and two separate sandbox escapes. The team reported these findings to Apple in February, and Apple's release of iOS 12.1.4 that same month addressed the issues.

Google's deep dive into the iOS exploit can be read on the company's Project Zero blog.

Top Rated Comments

(View all)
Avatar
11 months ago
So what were the malicious sites?
Score: 72 Votes (Like | Disagree)
Avatar
11 months ago
The defenders will soon be here trying to explain how Apple was not at fault and that the company is really trying to put privacy priority # 1 (ha...ha...ha).
Score: 29 Votes (Like | Disagree)
Avatar
11 months ago

Stick that on a billboard

Sure. Along with the time Google discovered a security flaw in Safari and instead of notifying Apple so they could fix it they wrote malware to exploit it so they could keep tracking users.

So the moral of the story is: If Google can somehow embarrass Apple over an exploit they'll release information to the public. If they can use the exploit to their own advantage, they'll keep quiet about it.
Score: 23 Votes (Like | Disagree)
Avatar
11 months ago

So what were the malicious sites?

Same question. Read the articles, and didn’t see them listed. Maybe I missed them... I feel google has the responsibility to disclose them.
Score: 18 Votes (Like | Disagree)
Avatar
11 months ago
Kudos to Google's Project Zero in spades.
GOTO: https://googleprojectzero.blogspot.com/2019/08/implant-teardown.html


"... we examined how the attackers gained unsandboxed code execution as root on iPhones. At the end of each chain we saw the attackers calling posix_spawn, passing the path to their implant binary which they dropped in /tmp. This starts the implant running in the background as root. There is no visual indicator on the device that the implant is running. There's no way for a user on iOS to view a process listing, so the implant binary makes no attempt to hide its execution from the system.

The implant is primarily focused on stealing files and uploading live location data. The implant requests commands from a command and control server every 60 seconds.

Before diving into the code let's take a look at some sample data from a test phone running the implant and communicating with a custom command and control server I developed. To be clear, I created this test specifically for the purposes of demonstrating what the implant enabled the attacker to do and the screenshots are from my device. The device here is an iPhone 8 running iOS 12.

The implant has access to all the database files (on the victim’s phone) used by popular end-to-end encryption apps like Whatsapp, Telegram and iMessage. We can see here screenshots of the apps on the left, and on the right the contents of the database files stolen by the implant which contain the unencrypted, plain-text of the messages sent and received using the apps..."

Score: 16 Votes (Like | Disagree)
Avatar
11 months ago

Sounds like working as intended. Bugs found, reported and fixed in the same month.

This.

Going to quote it simply to counter the inevitable posts saying Apple somehow screwed up....blah....blah....blah.

First off, Apple didn't ignore this exploit for years. They simply didn't know about it. The only reason it went unnoticed for so long is because it wasn't widespread. Once an exploit becomes common it's usually discovered quickly. This is why zero-days are so valuable and often sold to governments or others who can afford to pay a couple million for an exploit. It's also why those same people only use the exploits on targets they consider valuable, because once it's out there it will be discovered and fixed.

Secondly, Apple dealt with it immediately. Google notified Apple on Feb 1st and Apple released a patch on Feb 7th. This is a perfect example of Apple having superior security to Android. Exploits will always exist. Being able to quickly roll out a fix for an exploit is one of the most important methods in dealing with them. Something Android is absolutely horrible at.
Score: 16 Votes (Like | Disagree)

Top Stories

5.4-Inch iPhone 12 Model Size Compared to Original iPhone SE and iPhone 7

Saturday July 4, 2020 9:44 pm PDT by
iPhone 12 dummy models based on leaked schematics have been starting to circulate online and in online marketplaces. Not happy with the circulating size comparisons between the rumored 5.4" iPhone 12 and the original iPhone SE models, MacRumors forum user iZac took matters into his own hands and purchased his own 5.4" dummy model to provide more detailed size comparisons between the original...

Top Stories: iPhone 12 Rumors, Apple's A12Z-Based Mac mini, Leaked iMac, and More!

Saturday July 4, 2020 6:00 am PDT by
With WWDC now behind us, our attention this week largely turned back to rumors, led by increasing claims that Apple controversially won't be including a power adapter in the box with the iPhone 12. We also saw a few other iPhone 12 rumors, signs of an upcoming iMac update, and some more information on timing of updates for Apple's smaller iPads. The other big topic this week was Apple's...

Apple Survey Asks iPhone Users What They Do With Old Power Adapters

Friday July 3, 2020 10:13 am PDT by
Amid multiple reports that Apple will no longer include a power adapter in its iPhone boxes starting with the iPhone 12 later this year, it appears Apple is surveying recent iPhone buyers to ask about what they've done with the power adapters that came with their previous iPhones. Screenshot via Twitter user @bedabb_ Apple's surveys typically cover numerous aspects of its products, but...

Tom Hanks Discusses 'Heartbreaking' Shift of WWII Film Greyhound From Theatrical Blockbuster to Apple TV+ Exclusive

Monday July 6, 2020 7:53 am PDT by
Tom Hanks' WWII drama "Greyhound" is set to premiere on Apple TV+ this Friday, July 10, and ahead of that debut the actor gave an interview with The Guardian discussing the film. "Greyhound" was originally planned to see a theatrical release this summer, and was repeatedly delayed in the wake of the ongoing Covid-19 pandemic. Apple won the streaming rights to the film, and in the new...

Shipping Estimates for 27-Inch iMac Continue to Slip, Now Into September

Monday July 6, 2020 6:55 am PDT by
Amid rumors and hints of a forthcoming update for the iMac, supplies of Apple's current 27-inch iMac continue to dwindle with mid- and high-end stock configurations now seeing shipping estimates pushed back into September. The 27-inch iMac has seen tight supplies and extended shipping estimates for months now, but the situation has been gradually worsening to the point where new buyers can...

Apple Officially Obsoletes First MacBook Pro With a Retina Display

Wednesday July 1, 2020 3:40 am PDT by
As expected, Apple's first MacBook Pro with a Retina display is now officially classed as "obsolete" worldwide, just over eight years after its release. In a support document, Apple notes that obsolete products are no longer eligible for hardware service, with "no exceptions." This means that any mid-2012 Retina MacBook Pro 15-inch models still out there that require a battery or other...

First Arm-Based Macs to Be 13-Inch MacBook Pro and Redesigned iMac, Launches Coming in Late 2020 or Early 2021

Sunday June 21, 2020 9:18 am PDT by
Apple plans to introduce its Arm-based custom designed chips for Macs at WWDC, Apple analyst Ming-Chi Kuo said in a note to investors today, agreeing with an earlier report from Bloomberg. Kuo says that the first Mac models to adopt Arm-based chips will be the 13.3-inch MacBook Pro and an iMac with a redesigned form factor, with Apple planning to launch the new models in the in fourth...

Hands On With iPhone 12 Models Showing New Sizes and Design

Monday July 6, 2020 2:04 pm PDT by
Ahead of the launch of new iPhones we often see dummy models created based on leaked schematics and specifications, with those models designed to let case makers create cases for the new devices ahead of their release. We got our hands on a set of dummy models that represent the iPhone 12 lineup, giving us our first close look at the iPhone 4-style design and the different size options. Subscri ...

EU Advertisers Criticize New App Tracking Privacy Controls in iOS 14

Friday July 3, 2020 3:44 am PDT by
A Google-backed group of European digital advertising associations has criticized Apple for requiring apps in iOS 14 to seek additional permission from users before tracking them across other apps and websites, reports Reuters. Sixteen marketing associations, some of which are backed by Facebook and Alphabet's Google, faulted Apple for not adhering to an ad-industry system for seeking user...

LinkedIn Says iOS App Reading Clipboard With Every Keystroke is a Bug, Fix Coming

Friday July 3, 2020 1:08 pm PDT by
iOS 14 introduces a feature that alerts users when apps access their clipboards, and tons of apps have been caught clipboard snooping. LinkedIn is one of the iOS apps that has been reading user clipboards, and iPhone owners have complained that the app copies the contents of the clipboard with every keystroke. LinkedIn is copying the contents of my clipboard every keystroke. IOS 14 allows ...