Google says hackers have put ‘monitoring implants’ in iPhones for years

Extract from The Guardian

Hacking

Visiting hacked sites was enough for server to gather users’ images and contacts

Alex Hern

@alexhern

Fri 30 Aug 2019 17.03 AEST Last modified on Fri 30 Aug 2019 23.25 AEST

Operating systems from iOS 10 to iOS 12 were targeted in the hack. Photograph: Samuel Gibbs/The Guardian

An unprecedented iPhone hacking operation, which attacked “thousands of users a week” until it was disrupted in January, has been revealed by researchers at Google’s external security team.
The operation, which lasted two and a half years, used a small collection of hacked websites to deliver malware on to the iPhones of visitors. Users were compromised simply by visiting the sites: no interaction was necessary, and some of the methods used by the hackers affected even fully up-to-date phones.

Once hacked, the user’s deepest secrets were exposed to the attackers. Their location was uploaded every minute; their device’s keychain, containing all their passwords, was uploaded, as were their chat histories on popular apps including WhatsApp, Telegram and iMessage, their address book, and their Gmail database.
The one silver lining is that the implant was not persistent: when the phone was restarted, it was cleared from memory unless the user revisited a compromised site. However, according to Ian Beer, a security researcher at Google: “Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device.”
Beer is a member of Project Zero, a team of white-hat hackers inside Google who work to find security vulnerabilities in popular tech, no matter who it is produced by. The team has become controversial for its hardline approach to disclosure: 90 days after it reports a bug to the victim, it will publish the details publicly, whether or not the bug has been fixed in that time.
In total, 14 bugs were exploited for the iOS attack across five different “exploit chains” – strings of flaws linked together in such a way that a hacker can hop from bug to bug, increasing the severity of their attack each time.
“This was a failure case for the attacker,” Beer noted, since even though the campaign was dangerous, it was also discovered and disrupted. “For this one campaign that we’ve seen, there are almost certainly others that are yet to be seen.

“All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them.”

Google said it had reported the security issues to Apple on 1 February. Apple then released an operating system update which fixed the flaws on 7 February.