<story><title>Operation Triangulation: What you get when attack iPhones of researchers</title><url>https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/</url></story><parent_chain><item><author>mike_hearn</author><text>That&amp;#x27;s pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and&amp;#x2F;or that they hacked Apple and obtained internal hardware documentation (more likely).&lt;p&gt;I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and deliberately both hidden it, whatever it is, and then gone further and protected it with a sort of (fairly weak) digital signing feature.&lt;p&gt;As the blog post points out, there&amp;#x27;s no obvious way you could find the right magic knock to operate this feature short of doing a full silicon teardown and reverse engineering (impractical at these nodes). That leaves hacking the developers to steal their internal documentation.&lt;p&gt;The way it uses a long chain of high effort zero days only to launch an invisible Safari that then starts from scratch, loading a web page that uses a completely different chain of exploits to re-hack the device, also is indicative of a massive organization with truly abysmal levels of internal siloing.&lt;p&gt;Given that the researchers in question are Russians at Kaspersky, this pretty much has to be the work of the NSA or maybe GCHQ.&lt;p&gt;&lt;i&gt;Edit: misc other interesting bits from the talk: the malware can enable ad tracking, and also can detect cloud iPhone service hosting that&amp;#x27;s often used by security researchers. The iOS&amp;#x2F;macOS malware platform seems to have been in development for over a decade and actually does ML on the device to do object recognition and OCR on photos on-device, to avoid uploading image bytes: they only upload ML generated labels. They truly went to a lot of effort, but all that was no match for a bunch of smart Russian students.&lt;p&gt;I&amp;#x27;m not sure I agree with the speaker that security through obscurity doesn&amp;#x27;t work, however. This platform has been in the wild for ten years and nobody knows how long they&amp;#x27;ve been exploiting this hidden hardware &amp;quot;feature&amp;quot;. If the hardware feature was openly documented it&amp;#x27;d have been found much, much sooner.&lt;/i&gt;</text></item></parent_chain><comment><author>black_puppydog</author><text>&amp;gt; If the hardware feature was openly documented it&amp;#x27;d have been found much, much sooner.&lt;p&gt;Well, the point of kerckhoff&amp;#x27;s principle is that it &lt;i&gt;should&lt;/i&gt; have been openly documented and then anyone lookindg at the docs even pre-publication would have said &amp;quot;we can&amp;#x27;t ship it like that, that feature needs to go.&amp;quot;</text></comment>
<story><title>Operation Triangulation: What you get when attack iPhones of researchers</title><url>https://securelist.com/operation-triangulation-the-last-hardware-mystery/111669/</url></story><parent_chain><item><author>mike_hearn</author><text>That&amp;#x27;s pretty astonishing. The MMIO abuse implies either the attackers have truly phenomenal research capabilities, and&amp;#x2F;or that they hacked Apple and obtained internal hardware documentation (more likely).&lt;p&gt;I was willing to believe that maybe it was just a massive NSA-scale research team up until the part with a custom hash function sbox. Apple appears to have known that the feature in question was dangerous and deliberately both hidden it, whatever it is, and then gone further and protected it with a sort of (fairly weak) digital signing feature.&lt;p&gt;As the blog post points out, there&amp;#x27;s no obvious way you could find the right magic knock to operate this feature short of doing a full silicon teardown and reverse engineering (impractical at these nodes). That leaves hacking the developers to steal their internal documentation.&lt;p&gt;The way it uses a long chain of high effort zero days only to launch an invisible Safari that then starts from scratch, loading a web page that uses a completely different chain of exploits to re-hack the device, also is indicative of a massive organization with truly abysmal levels of internal siloing.&lt;p&gt;Given that the researchers in question are Russians at Kaspersky, this pretty much has to be the work of the NSA or maybe GCHQ.&lt;p&gt;&lt;i&gt;Edit: misc other interesting bits from the talk: the malware can enable ad tracking, and also can detect cloud iPhone service hosting that&amp;#x27;s often used by security researchers. The iOS&amp;#x2F;macOS malware platform seems to have been in development for over a decade and actually does ML on the device to do object recognition and OCR on photos on-device, to avoid uploading image bytes: they only upload ML generated labels. They truly went to a lot of effort, but all that was no match for a bunch of smart Russian students.&lt;p&gt;I&amp;#x27;m not sure I agree with the speaker that security through obscurity doesn&amp;#x27;t work, however. This platform has been in the wild for ten years and nobody knows how long they&amp;#x27;ve been exploiting this hidden hardware &amp;quot;feature&amp;quot;. If the hardware feature was openly documented it&amp;#x27;d have been found much, much sooner.&lt;/i&gt;</text></item></parent_chain><comment><author>aberoham</author><text>Also note the IoC script — This script allows to scan iTunes backups for indicator of compromise by Operation Triangulation. &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;KasperskyLab&amp;#x2F;triangle_check&quot;&gt;https:&amp;#x2F;&amp;#x2F;github.com&amp;#x2F;KasperskyLab&amp;#x2F;triangle_check&lt;/a&gt;</text></comment>