Slashdot Mirror
Apple Fixes Three Zero Days Used In Targeted Attack (onthewire.io)
Trailrunner7 quotes a report from On The Wire: Apple has patched three critical vulnerabilities in iOS that were identified when an attacker targeted a human rights activist in the UAE with an exploit chain that used the bugs to attempt to remotely jailbreak and infect his iPhone. The vulnerabilities include two kernel flaws and one in WebKit and Apple released iOS 9.3.5 to fix them.
The attack that set off the investigation into the vulnerabilities targeted Ahmed Mansoor, an activist living in the UAE. Earlier this month, he received a text message that included a link to what was supposedly new information on human rights abuses. Suspicious, Manor forwarded the link to researchers at the University of Toronto's Citizen Lab, who recognized what they were looking at. "On August 10 and 11, 2016, Mansoor received SMS text messages on his iPhone promising ;new secrets' about detainees tortured in UAE jails if he clicked on an included link. Instead of clicking, Mansoor sent the messages to Citizen Lab researchers. We recognized the links as belonging to an exploit infrastructure connected to NSO Group, an Israel-based 'cyber war' company that sells Pegasus, a government-exclusive "lawful intercept" spyware product," Citizen Lab said in a new report on the attack and iOS flaws.
The attack that set off the investigation into the vulnerabilities targeted Ahmed Mansoor, an activist living in the UAE. Earlier this month, he received a text message that included a link to what was supposedly new information on human rights abuses. Suspicious, Manor forwarded the link to researchers at the University of Toronto's Citizen Lab, who recognized what they were looking at. "On August 10 and 11, 2016, Mansoor received SMS text messages on his iPhone promising ;new secrets' about detainees tortured in UAE jails if he clicked on an included link. Instead of clicking, Mansoor sent the messages to Citizen Lab researchers. We recognized the links as belonging to an exploit infrastructure connected to NSO Group, an Israel-based 'cyber war' company that sells Pegasus, a government-exclusive "lawful intercept" spyware product," Citizen Lab said in a new report on the attack and iOS flaws.
OMFG I bought an iPhone because it's supposed to be safe!!!
Thank god I use android where such bug fixes will never make it to my phone.
To Jail Break not just one iPhone but 1 million iPhones is a battle that Apple Inc. thanks to Timmy Cook has already lost.
Exactly how long has Apple known about these holes though.
They maybe zero days to everyone else,Apple could have known about them all the time and left them open on purpose.
I wouldn't trust Apple or anyone connected with Apple to tell me if I was stood up or laying down..
Also v7 just hit for those in the beta program.
What updates does one need from a carrier? They have nothing to do with the operating system.
This news was already reported on Thursday.
https://apple.slashdot.org/story/16/08/25/1813236/malware-sold-to-governments-helped-them-spy-on-iphones
Although the news that Apple fixed the 3 vulnerabilities was not in Thursday's summary, it was mentioned in the article, and in the comments.
Few. Any. Time. Soon. Give. It. Up.
That's not how iOS works. The carriers just carry. Apple provides the update -- to the user's device. The carrier has no say in it at all.
Or, are you implying that the carriers will refuse to carry the update? That would be selective blocking / filtering, and once that story breaks, well, it'll be pitchforks and torches against those carriers.
And, to cover any misunderstandings, if the phone has no carrier, it cannot transmit, either.
So... what was your point, again?
The "Civilized World" jumped the shark ca. 1973.
It's quite resistant to remote hacks.
It shouldn't, but it does. Never buy a phone that has the carriers name printed on the case, or has a carriers icon anywhere in default OS.
Carriers regularly act as gateways to updates that only permit approved updates (i.e. ones that don't cause their network issues). It is a pain in the arse but it is reality.
And, to cover any misunderstandings, if the phone has no carrier, it cannot transmit, either.
So... what was your point, again?
You can use a iPhone with no carrier. I do all the time. You just use wifi enabled calling and sms. It's a lot cheaper, much less of a headache, and quite convienent for some people who nearly always have access wifi.
Not for iOS. Is this an Android "feature"?
You can use a iPhone with no carrier. I do all the time. You just use wifi enabled calling and sms. It's a lot cheaper, much less of a headache, and quite convienent for some people who nearly always have access wifi.
Certainly. That's how I use it at home, at friend's houses, and the like. Well, except for the wi-fi calling and SMS.
That's still transmitting, just through a different carrier -- if we're on wi-fi we're using whatever carrier (ISP) our host has. Comcrap for me, AT&T Uworse for my buddy.
I rarely call... I usually imessage.. not even SMS. The one guy I call on a regular basis doesn't even have a cellphone. Luddite! ;o) It's either phone, or email with him. He literally has no cellphone. The only person I know that doesn't.
We do swap Enigma messages, as a hobby, though. I wonder what NSA makes of that. Boring stuff, usually Kancolle garbage. I wonder if NSA has figured out what "poi" is.....
The "Civilized World" jumped the shark ca. 1973.
It's more about Apple strong-arming the carriers into an agreement where Apple can roll out any software they want to any iPhone at any time, WITHOUT the carriers' approval or testing, and even without allowing the carriers to inject their own software (bloatware) into the image.
All other smartphone vendors are, at least individually, not in a position of enough strength to try and tell Verizon, AT&T, Telstra, Orange, etc. that they don't get to make any software customizations or do their own testing. So therefore all Android phones' updates have to go through the carriers, but Apple updates don't.
"Apples" is the new parent company. .. ...
Subsidiaries are:
"Idared" - products: I-Phone, I-PAD,
"Macintosh" - Mac products.
"This needs to be severely punished by the international community"
The "international community" creates their own software tools or purchases them from someone else. The international community is a myth just like international law. It's every country for it's self. There are no permanent allies or enemies there are only interests which change over the years. Israel's technology sector comes close matching the US. Their military technologies are regarded as some of the best in the world. The US supports Israel because it provides the leverage they need to dissuade Israel from selling some of it's weapon systems to countries the US identifies as enemies. US drone and missile defense systems contain a lot of Israeli technology.
Yup, and it's why I ditched Android for iOS.
As for jailbreaking and whatnot, "ain't nobody got time for that".
Ditto.
Ant(Dude) @ Quality Foraged Links (AQFL.net) & The Ant Farm (antfarm.ma.cx / antfarm.home.dhs.org).
The awesome thing is that zero days are expensive, and these guys just burned three of them. That isn't endearing them to their supplier, who now needs to work up fresh ones. Lol, suckers!
Should be Mansoor not Manor.
I didn't know that Israel is not supporting UAE government, because I once thought all GCC countries cannot even accept Israelis as tourist in their country. Not even an overfly of Israel registered aircrafts on any GCC member. If that was already removed, then this is good news.
Heh you think that either the UAE or Saudi government had nothing do with this? The hate Isreal part of their rhetoric is only for the consumption of the common people. When it comes to cyber-arms deals they really don't give a damn about it.
> Never buy a phone that has the carriers name printed on the case, or has a carriers icon anywhere in default OS.
This story is about Apple. Here's how you update your Apple iPhone: Go to Settings, select "general", and then hit "software update". This works on any carrier.
Some Androids have this problem. Apple literally never does.
Are you sure you are using SMS without a carrier?
You are probably using iMessage and facetime. Both work fine without a carrier, but you'll be limited to apple devices on both sending and receiving.
Dream on.
Israel can do no wrong. The US and WW2 legacy ensure that they can do whatever they want and no one will ever be able to do anything about it.
https://info.lookout.com/rs/05...
Only if you agree crazy enough to buy your phone from the carrier.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
And, to cover any misunderstandings, if the phone has no carrier, it cannot transmit, either.
If by no carrier, you mean no nearby cell towers, I would agree.
If a phone has access to a carrier's tower, I would not be surprised to find out that it could transmit surreptitiously.
If you can make a 911 call on a phone without a sim card, I see no reason as to why a carrier couldn't track you via IMEI number. And if they can identify your IMEI, why couldn't they enable you to communicate without having a proper sim? Sure, this requires the government to be buddy-buddy with the carrier...
I read the article, trying to figure out who was targeting the activist. Israeli company NSO provides the attack to probably the UAE (who had previously been targeting Mansoor). NSO is majority owned by US private equity firm Francisco Partners. I wouldn't expect either group (Francisco/NSO) to be interested in quashing democracy in UAE.
Right, but wrong to blame on Android..its a manufacturer feature. Planned obselance. Such, as, I have a hp7 1800, tablet that I'll have to jailbreak soon, the manufacturer won't update this fully functional tablet. Works like a charm, but,getting slower as it ages. As it has to interpret the new permissions to older ways.
But the article sounds new, and the fix was on hand? Fixed in days? Sounds like bass to me.
"And, to cover any misunderstandings, if the phone has no carrier, it cannot transmit, either."
None of these quibbles apply if you just download your iOS updates over WiFi, which you want to do in any case to avoid burning through your data cap. It's a swich right there in Settings.
"You can use a iPhone with no carrier."
You can also set one up with a prepaid carrier rather than a fixed monthly contract.
It's more about Apple strong-arming the carriers into an agreement where Apple can roll out any software they want to any iPhone at any time, WITHOUT the carriers' approval or testing
That is bollocks.
Software upgrades don't affect the carrier at all.
How should they?
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.
Does democracy pay as much as the alternative?
If I have been able to see further than others, it is because I bought a pair of binoculars.
It's nothing to do with causing network issues, virtually all carriers can't stop you connecting your own handsets that could be running anything.
It's all about branding, forcing their brand in your face and all the bloated crap they want to put on the handsets that the users will never use.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
I'm not arguing whether software updates to devices should or shouldn't affect or be approved by carriers; I'm telling you that they *are*. Factually. It's a known thing; look it up. The carriers themselves admit it.
If you are using a smartphone that was not manufactured by Apple, and you live in a country where large corporations own and operate the telecommunications infrastructure, especially the United States, UK and Australia, there is a very good chance that your carrier actively tests, modifies, and must approve all operating system software updates being applied to your phone, *before* that software can be rolled out to you.
Of course, if you've rooted and/or unlocked the bootloader of your phone, you can choose to apply your own changes to the system. But if you've had to exploit a security vulnerability to gain this access because the carriers don't legitimately provide that access to you, chances are good that the vulnerability you used to gain access is still there, and someone else could use it to compromise your device. Not good.
But back to my original point. It's not "bollocks" because carriers *do* care, very much, about what software manufacturers are deploying via OTAs to consumers. This is why any Android device you buy from Verizon Wireless comes with an NFL app pre-installed, along with several others, including Verizon-specific apps that nag you to try and get you to use their first-party add-on services and consume their paid content. That's not the manufacturer. That's 100% the carrier.
You may be totally unaware of this because you're lucky enough to have a carrier that does not behave this way, but surely you can at least see the justification why a for-profit company would think this would be a good idea. I'm sure they aren't installing the NFL app on your phone out of reverence for the sport of American football; why, I'd wager the NFL might actually pay them a small amount of money for each phone they sell that ships their app pre-loaded. Similarly, I doubt they merely want to offer you free, ad-free television when they pre-load their Verizon streaming service app on your phone. The probability of their service having both excessive in-app advertisements *and* a monthly subscription fee is approximately 100%. Welcome to capitalism.
If you are using a smartphone that was not manufactured by Apple, and you live in a country where large corporations own and operate the telecommunications infrastructure, especially the United States, UK and Australia, there is a very good chance that your carrier actively tests, modifies, and must approve all operating system software updates being applied to your phone, *before* that software can be rolled out to you.
Perhaps the carriers demand that, but it makes no sense.
The software can not interfere with e the ECF (or is it EFC?) certified parts of your phone so regardless what software is on it, it can't interfere with the network of the carrier.
But back to my original point. It's not "bollocks" because carriers *do* care, very much, about what software manufacturers are deploying via OTAs to consumers. :D
Via "OTA" perhaps, what ever that is
But I can simply install any "app" or OS upgrade how ever I want on any carrier I ever was on, regardless of iOS or Android.
Cost free eBook I read (by iBook/Kobo/Amazon/ObookO/Gutenberg etc.): "The Green Odyssey" by Philip Jose Farmer.