Slashdot Mirror
'Exodus' Spyware Found Targeting Apple iOS Users (threatpost.com)
The surveillance tool dubbed "Exodus" has been ported to the Apple iOS ecosystem. According to Threatpost, the spyware "can exfiltrate contacts, take audio recordings and photos, track location data and more on mobile devices." From the report: Earlier this month, word came that Google had booted a raft of Exodus-laden apps. According to Lookout Security, it turns out that iOS versions had become available outside the App Store, through phishing sites that imitate Italian and Turkmenistani mobile carriers. These are notable in that they abused the Apple Developer Enterprise program. According to Lookout and other research from Security Without Borders, the spyware appears to have been under development for at least five years. It's a three-stage affair, starting with a lightweight dropper that then fetches a large second-stage payload that contains multiple binaries with most of the spy goods housed within them. Finally, a third stage typically uses the Dirty COW exploit (CVE20165195) to obtain root privileges on a targeted device. In delving into the technical details, Lookout saw evidence of a fairly sophisticated operation, suggesting that it may have been initially marketed as a legitimate package for the government or law-enforcement sectors.
In order to spread the iOS app outside of the official App Store, the cybercriminals abused Apple's enterprise provisioning system, which allowed them to sign the apps using legitimate Apple certificates. Lookout's analysis found that the iOS variant is a bit cruder than its Android counterpart, and it lacks the ability to exploit device vulnerabilities. However, the apps were still able to use documented APIs to exfiltrate contacts, photos, videos and user-recorded audio recordings, device information and location data; and, it offered a way to perform remote audio recording, though this required push notifications and user interaction. The good news is that Apple has revoked the affected certificates for this particular crop of apps.
In order to spread the iOS app outside of the official App Store, the cybercriminals abused Apple's enterprise provisioning system, which allowed them to sign the apps using legitimate Apple certificates. Lookout's analysis found that the iOS variant is a bit cruder than its Android counterpart, and it lacks the ability to exploit device vulnerabilities. However, the apps were still able to use documented APIs to exfiltrate contacts, photos, videos and user-recorded audio recordings, device information and location data; and, it offered a way to perform remote audio recording, though this required push notifications and user interaction. The good news is that Apple has revoked the affected certificates for this particular crop of apps.
Speaking about exploited, dirty cows... /I didn't copy this on write
Let them be free. They wanna be free.
Of note is this last part:
Lookout's analysis found that the iOS variant is a bit cruder than its Android counterpart, and it lacks the ability to exploit device vulnerabilities. However, the apps were still able to use documented APIs to exfiltrate contacts, photos, videos and user-recorded audio recordings, device information and location data
Since it only uses documented API's, that means separate prompts each to access location, photos/video, and contacts. I'm not even sure how it would get to user-recorded audio recordings outside the app unless it also popped up a browser for iCloud Drive files... That's a pretty big set of permission asks for any one app, between that and having to download and trust the enterprise certificate for the apps (in itself a bit of a process) I wonder how many takers they actually get.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
will it be too predictable?
Looking for people to chat about multicopters, coding, music. skype: gtsiros
Finally, a third stage typically uses the Dirty COW exploit (CVE20165195) to obtain root privileges on a targeted device
What does that have to do with iOS? That's a Linux kernel vulnerability. The summary is totally mashing up the iOS and Android aspects into one glob.
https://en.wikipedia.org/wiki/...
Better known as 318230.
Why does slashdot allow this crap to be published and then censors people who question thier editors?
Here's my answer- because they like the message that these people are putting out.
The Nazis , the trumptards, the orange man good/bad folks, are all put here by the editors.
This site has become toxic
You must be new here right?
The surveillance tool dubbed "iOS" has been ported to the Apple iOS ecosystem. According to Threatpost, the spyware "can exfiltrate contacts, take audio recordings and photos, track location data and more on mobile devices." From the report:
According to Lookout Security, it turns out that iOS versions had become in the "App Store", a phishing site that imitates legitimate software repositories. These are notable in that they used the "Apple Developer Enterprise" program. According to Lookout and other research from Security Without Borders, the spyware appears to have been under development for at least five years. It's a multi-stage affair, starting with a lightweight mp3 player that then escallates to a large handheld phone that contains multiple binaries with most of the spy goods housed within them. Finally, a third stage typically uses the brain-computer interface to obtain root privileges on a targeted person. In delving into the technical details, Lookout saw evidence of a fairly sophisticated operation, suggesting that it may have been initially marketed as a legitimate package for the government or law-enforcement sectors.
In order to spread the iOS app outside of the official App Store, the cybercriminals used Apple's enterprise provisioning system, which allowed them to sign the apps using legitimate Apple certificates. Lookout's analysis found that this iOS variant is a bit cruder than its Android counterpart, and it lacks the ability to exploit device vulnerabilities. However, the apps were still able to use documented APIs to exfiltrate contacts, photos, videos and user-recorded audio recordings, device information and location data; and, it offered a way to perform remote audio recording, though this required push notifications and user interaction. There is no good news.
GENERATION 26: The first time you see this, copy it into your sig on any forum and add 1 to the generation.
So why has /. not reported the far more egregious instance of Huawei caught spying in Pakistan?
https://www.bbc.co.uk/programmes/n3ct4p0f
https://www.bbc.co.uk/news/technology-47856098