Quote:Researchers at Kaspersky Lab have revealed that hackers had exploited some undocumented hardware features to breach iPhones. The target attacks were a part of the Operation Triangulation mercenary spyware campaign, which we reported about in June this year.

Alarmingly, the attacks have compromised users for about 4 years, since 2019, allowing threat actors to spy on a user's photos, location, etc.

The security analysts presented their findings at the 37th Chaos Communication Congress (37C3), held at Congress Center Hamburg, Germany. Kaspersky engineers Boris Larin, Leonid Bezvershenko, Georgy Kucherin, Igor Kuznetsov, Valentin Pashkov, and Mikhail Vinogradov investigated the Operation Triangulation attacks. The analysts had found over 30 in-the-wild zero-days in Adobe, Apple, Google, and Microsoft products. But, the attacks that targeted iPhones were the most sophisticated.

They reverse engineered the attacks to discover how the malware impacted users. The exploits were tracked under CVE-2023-32434, CVE-2023-32435, CVE-2023-38606 and CVE-2023-41990. Apple patched these security issues in iOS and iPadOS over the past year, after the security researchers reported the bugs to the company.

Operation Triangulation was a sophisticated attack

The process, as explained on Securelist.com, was quite complicated. The following screenshot illustrates how the Operation Triangulation attack chain was used to breach a victim's iPhone.




I'll outline the method here briefly. The hackers had used four zero-days that worked on iOS, to be precise, until iOS 16.2. An attacker would send a malicious iMessage attachment to an iPhone user, for example, a PDF file. The app would process it without any interaction from the user, aka it was a 0-click iMessage attack. This attachment is used for remote code execution, which was possible as a result of a vulnerability ( CVE-2023-41990) this time related to a TrueType font instruction.
...