Sources: a number of recently disclosed malicious websites used to hack into iPhones over a two-year period were designed to target Uyghur Muslims in China

A number of malicious websites used to hack into iPhones over a two-year period were targeting Uyghur Muslims, TechCrunch has learned.

TechCrunch 2019-09-01 Zack Whittaker

Discussion

@neilcybart Neil Cybart on x
This TechCrunch article on new developments related to the iPhone hacks via malicious websites is a well-written piece. Genuine reporting. No sensational boilerplate language about Apple. No hidden agenda. https://techcrunch.com/...
@thegrugq Thaddeus E. Grugq on x
shocked. shocked. who ever could have guessed? 😑🙄 https://twitter.com/...
@blowdart Barry Dorrans on x
I wonder if telemetry doesn't make it out of China. Remember all the cloud hosting there is ran by a Chinese company under license.
@zackwhittaker Zack Whittaker on x
Exclusive: Malicious websites used to quietly hack into iPhones over the past two years was an effort by China to target Uyghur Muslims. https://techcrunch.com/...
@malwaretechblog @malwaretechblog on x
Update: rumor is it was China targeting Uighur Muslims. An authoritarian government targeting dissidents was the most likely explanation, though my first guess would have been a gulf state. https://techcrunch.com/...
@perito_inf @perito_inf on x
Implant Teardown The implant has access to all the database files (on the victim's phone) used by popular end-to-end encryption apps like Whatsapp, Telegram and iMessage. https://googleprojectzero.blogspot.com/ ...
@ggreeneva Greg Greene on x
This scoop — that the massive hack exploiting multiple zero-day iOS vulnerabilities was likely a state-sponsored Chinese surveillance program — is utterly believable. https://twitter.com/...
@stevebellovin Steven Bellovin on x
Per https://arstechnica.com/..., the attackers were interested in activity on Tencent. To me, that strongly suggests Chinese internal security agencies are behind the malware. Also, the sites had “thousands of visitors per week”. These days, that's not very many. 1/2
@cramforce Malte Ubl on x
If Apple allowed browser engine diversity on iOS, then fewer than 100% of iOS users would have been vulnerable over this 2 year period https://www.washingtonpost.com/ ...
@ericgeller Eric Geller on x
You were very likely not hacked by this. The infected websites received very little traffic, Google said. The news is mostly significant because of how rare iOS zero-days are and because this campaign was indiscriminate, not targeted, raising questions about who did it and why.
@alexstamos Alex Stamos on x
Many things to learn from this incident, but one is the safety cost of anti-competitive iOS App Store policies. Chrome/Brave/Firefox are required to use the default WebKit/JS. If Apple isn't going to put in the work necessary to protect users then they should let others do so. ht…
@lukolejnik Lukasz Olejnik on x
The implant was used to steal location data and files like databases of WhatsApp, Telegram, iMessage. So all the user messages, or emails. Copies of contacts, photos, https://googleprojectzero.blogspot.com/ ... https://twitter.com/...
@alexstamos Alex Stamos on x
It's darkly ironic that Apple is the company that is demonstrating the end point of late-90's fears about Microsoft. ✅Rent seeking via platform control. ✅Content moderation on behalf of autocracies ✅Risk of software monoculture[1] [1] http://blough.ece.gatech.edu/ ...
@mikeisaac Rat King on x
can someone tell me the rationale of google disclosing all this info but not identifying the sites? is it in fear of drawing people to them? https://www.wired.com/...
@malwarejake Jake Williams on x
This, plus a hardcoded HTTP IP address is amateur hour. Contrast that with multiple exploit chains and sandbox escapes and it sure sounds like a group with tons of money to buy exploits and little operational experience. So many thoughts right now... https://googleprojectzero.blo…
@stshank Stephen Shankland on x
A dig from a Googler about Apple's ostensibly security-minded (in part) reason for allowing only its own browser engine on iOS & iPadOS. (Chrome, Firefox, etc. are available on iOS, but unlike on MacOS, Windows, Android, are required to use Apple's WebKit browser engine.) https:/…
@rmogull Rich Mogull on x
I'm trying to decide if learning of indiscriminate iOS zero day attacks in the wild is just incredibly concerning, or the biggest iOS security news since the launch of the platform: https://googleprojectzero.blogspot.com/ ...
@martijn_grooten Martijn Grooten on x
There's a lot to say about the iPhone watering hole attacks, but if you work with vulnerable groups in China this, and the fact that P0 talked about “entire populations”, means should you take extra notice of what happened https://googleprojectzero.blogspot.com/ ... https://googl…
@alexstamos Alex Stamos on x
Remember how everybody lost their mind over Microsoft Palladium? At the time, “huge corporation will use hardware-rooted DRM to censor content choices by end users” seemed the worst-case scenario. That is literally the impact of Apple's DRM in China. https://epic.org/... https://…
@reneritchie Rene Ritchie on x
Terrific drill-down on a web-based iOS exploit chain. But, I can't find any info on what kind of sites were being used? If they were a tiny cluster in a remote region vs. major multinational, it's a very different threat level. https://googleprojectzero.blogspot.com/ ...
@alexhern Alex Hern on x
As this has filtered from the security community to the mainstream, something's been lost in translation, so I want to be explicit: this is not an aggressive move by Google, and it's not part of the wider conflict between the two companies. https://www.theguardian.com/ ...
@ericgeller Eric Geller on x
HUGE mobile security news: Google found malicious websites indiscriminately hacking iPhones using at least 5 separate exploit chains w/ *14* individual 0days. https://googleprojectzero.blogspot.com/ ... This is like finding a live colossal squid at the beach. Just *one* iOS 0day …
@zittrain Jonathan Zittrain on x
Apple iOS has been considered the most secure smartphone OS. Disconcerting that flaws could be strung together not only to own the phone, but to do it in bulk for all users visiting a compromised/ing web site. https://twitter.com/... https://twitter.com/...
@kennethgeers Kenneth Geers on x
Strategic iOS Attack —> “rare and intricate chains of code exploited a total of 14 security flaws” https://www.wired.com/...
@cynicalsecurity Arrigo Triulzi on x
All I am going to say about the iOS exploit chains write up by Project Zero is: “Bloody Hell!”. In the most profound British understatement tone I can muster. https://googleprojectzero.blogspot.com/ ...
@savicali Savic Ali on x
Privacy is an illusion in digital world. https://twitter.com/...
@craiu Costin Raiu on x
So, people with access to big chunks of network traffic should probably scout for HTTP POSTs to “/list/suc?name=”. https://googleprojectzero.blogspot.com/ ...
@malwaretechblog @malwaretechblog on x
This is wild. A group were using hacked websites to indiscriminately exploit iPhones using zero days exploits, and somehow went unnoticed for years. https://googleprojectzero.blogspot.com/ ...
@jason_koebler Jason Koebler on x
this is crazy crazy crazy crazy crazy. Upends everything I thought I knew about iPhone security. https://www.vice.com/...
@_danielsinclair Daniel Sinclair on x
Wow. This Project Zero discovery is insane. Some unnamed entity (obviously a government) had 7 Safari 0-days that have been quietly compromising iPhones for years — all the way back to iOS 10. Anyone who visited these unnamed sites were sunk. https://googleprojectzero.blogspot.co…
@alexstamos Alex Stamos on x
This is a huge find by Google's team. Attribution for these sites is going to be critical to understanding what impact they might have had. https://twitter.com/...
@da_667 @da_667 on x
the iOS 0-day/implant that google TAG found just really goes to show you why there is such a big market for iOS 0-days. With the right exposure, its intelligence goldmine that reaps massive dividends.
@motherboard @motherboard on x
Thousands of iPhones per week have been indiscriminately hacked for YEARS and no one knew: https://www.vice.com/...
@howelloneill Patrick Howell O'Neill on x
Google's Threat Analysis Group found hacked sites being used in watering hole attacks using five distinct iPhone 0-day exploit chains. The websites had thousands of visitors per week. Project Zero's analysis starts here: https://googleprojectzero.blogspot.com/ ...

Chronicles

Sources: a number of recently disclosed malicious websites used to hack into iPhones over a two-year period were designed to target Uyghur Muslims in China

Related Coverage

Discussion