Home Security New Report Exposes Operation Triangulation’s Spy ware Implant Concentrating on iOS Units

New Report Exposes Operation Triangulation’s Spy ware Implant Concentrating on iOS Units

by crpt os


Jun 21, 2023Ravie LakshmananMobile Security / Spyware

More details have emerged about the spyware implant that’s delivered to iOS devices as part of a campaign called Operation Triangulation.

Kaspersky, which discovered the operation after becoming one of the targets at the start of the year, said the malware has a lifespan of 30 days, after which it gets automatically uninstalled unless the time period is extended by the attackers.

The Russian cybersecurity company has codenamed the backdoor TriangleDB.

“The implant is deployed after the attackers obtain root privileges on the target iOS device by exploiting a kernel vulnerability,” Kaspersky researchers said in a new report published today.

Cybersecurity

“It is deployed in memory, meaning that all traces of the implant are lost when the device gets rebooted. Therefore, if the victim reboots their device, the attackers have to reinfect it by sending an iMessage with a malicious attachment, thus launching the whole exploitation chain again.”

Operation Triangulation entails the use of zero-click exploits via the iMessage platform, thereby allowing the spyware to complete control over the device and user data.

“The attack is carried out using an invisible iMessage with a malicious attachment, which, using a number of vulnerabilities in the iOS operating system, is executed on a device and installs spyware,” Eugene Kaspersky, CEO of Kaspersky, previously said.

“The deployment of the spyware is completely hidden and requires no action from the user.”

TriangleDB, written in Objective-C, forms the crux of the covert framework. It’s designed to establish encrypted connections with a command-and-control (C2) server and periodically send a heartbeat beacon containing the device metadata.

The server, for its part, responds to the heartbeat messages with one of 24 commands that make it possible to dump iCloud Keychain data and load additional Mach-O modules in memory to harvest sensitive data.

This includes file contents, geolocation, installed iOS applications, and running processes, among others. The attack chains culminate with the erasure of the initial message to cover up the tracks.

UPCOMING WEBINAR

🔐 Mastering API Security: Understanding Your True Attack Surface

Discover the untapped vulnerabilities in your API ecosystem and take proactive steps towards ironclad security. Join our insightful webinar!

Join the Session

A closer examination of the source code has revealed some unusual aspects where the malware authors refers to string decryption as “unmunging” and assign names from database terminology to files (record), processes (schema), C2 server (DB Server), and geolocation information (DB Status).

Another notable aspect is the presence of the routine “populateWithFieldsMacOSOnly.” While this method is nowhere called in the iOS implant, the naming convention raises the possibility that TriangleDB could also be weaponized to target macOS devices.

“The implant requests multiple entitlements (permissions) from the operating system,” Kaspersky researchers said.

“Some of them are not used in the code, such as access to camera, microphone and address book, or interaction with devices via Bluetooth. Thus, functionalities granted by these entitlements may be implemented in modules.”

It’s currently not known who is behind the campaign and what their ultimate objectives are. Apple, in a previous statement shared with The Hacker News, said it has “never worked with any government to insert a backdoor into any Apple product and never will.”

The Russian government, however, has pointed fingers at the U.S., accusing it of breaking into “several thousand” Apple devices belonging to domestic subscribers and foreign diplomats as part of what it claimed to be a reconnaissance operation.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.





Source link

Related Articles

xxxanti beeztube.mobi hot sexy mp4 menyoujan hentaitgp.net jason voorhees hentai indian soft core chupatube.net youjzz ez2 may 8 2023 pinoycinema.org ahensya ng pamahalaan pakistani chut ki chudai pimpmovs.com www xvedio dost ke papa zztube.mobi 300mbfilms.in صور مص الزب arabporna.net نهر العطش لمن تشعر بالحرمان movierulz plz.in bustyporntube.info how to make rangoli video 穂高ゆうき simozo.net 四十路五十路 ロシアav javvideos.net 君島みお 無修正 افلام سكس في المطبخ annarivas.net فيلم سكس قديم rashmi hot videos porncorn.info audiosexstories b grade latest nesaporn.pro high school girls sex videos real life cam eroebony.info painfull porn exbii adult pics teacherporntrends.com nepali school sex