Earlier this month, security researchers for Google’s Project Zero revealed a wild iOS exploit that would allow a malicious actor to completely take over a targeted device with absolutely no interaction from the device owner themselves. Apple ultimately patched the exploit, though there’s no indication that the exploit was actually used in the wild.
The same, however, can’t be said about a new piece of malware recently disclosed by security researchers working for Google’s Project Zero. In a jaw-dropping report, Ian Beer of Project Zero reveals how a collection of hacked websites distributed malware to any iOS device that visited the site in question. The malware relied upon quite a few 0-day vulnerabilities in iOS and reportedly impacted devices running iOS 10 through iOS 12.
The sites serving up the malware weren’t mentioned but are said to receive upwards of thousands of visitors a week. And speaking to the sophistication of the attack, the malware reportedly relied upon a chain of 14 security exploits.
“TAG was able to collect five separate, complete and unique iPhone exploit chains, covering almost every version from iOS 10 through to the latest version of iOS 12,” Beer notes. “This indicated a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years.”
Once an impacted website was visited, malware implanted onto the device began collecting all sorts of sensitive user data behind the scenes. According to the report, the iOS malware in question was able to steal a treasure trove of information, including but not limited to text messages, photos, and even GPS location data in real-time.
The websites in question were s ..
Support the originator by clicking the read the rest link below.
