Apple Fixes Security Flaws Exploited in Russian Hacking Campaign

Apple has announced that it has fixed two security flaws in its iPhones and iPads that were being used to hack thousands of devices in Russia. The seriousness of the campaign was underscored by Russian intelligence, which blamed the United States for the attacks. The discovery of the flaws was credited to researchers from Russian security software maker Kaspersky Lab, who had previously announced that their senior employees were among those targeted.

According to Kaspersky, the attack worked by sending an iMessage with a malicious attachment. Once the user’s phone was infected, the attacker could run code of their choosing. The infection would disappear when users turned their phones off and on again, and Apple’s optional Lockdown Mode also blocked the attacks. Kaspersky provided more details about the attack, revealing that the malicious code installed after infection had 24 commands, including extracting passwords from Apple’s Keychain, monitoring locations, and modifying or exporting files.

Apple stated that the fixes would protect iPhones running iOS 15.7 or earlier, which became out of date in September. More recent versions of the operating system had other improvements that made them impervious to the attacks. Apple also noted that 90 percent of customers who bought devices in the past four years have updated to iOS 16, the latest major release.

Kaspersky expressed gratitude to Apple for working together to analyze and repair the flaws. The security software maker has previously exposed sophisticated spying tools used by the National Security Agency (NSA), including those related to Stuxnet, which disabled Iranian uranium enrichment tools. However, Kaspersky faced backlash when U.S. officials claimed that its consumer anti-virus program had been used to extract classified material from an intelligence employee’s home computer. As a result, Kaspersky was banned from federal machines and its share of the U.S. market plummeted.

The infection technique used in this recent attack, known as Triangulation, is similar to that used by NSO and other vendors of high-end spyware. The White House and other U.S. officials have blacklisted NSO for its dealings with repressive governments that engage in spying on innocent citizens.

How did Apple address the security flaws in its iPhones and iPads used to hack devices in Russia?

Apple Fixes Security Flaws in iPhones and iPads Used to Hack Devices in Russia

Apple has recently announced that it has successfully addressed two security flaws in its iPhones and iPads, which were being exploited to hack thousands of devices in Russia. The severity of the attacks prompted Russian intelligence to accuse the United States of being responsible for the breaches. The discovery of these vulnerabilities is credited to researchers from Kaspersky Lab, a Russian security software maker, who had previously revealed that their senior employees were among the targets.

According to Kaspersky, the hacking campaign involved sending malicious attachments via iMessage. Once the recipient’s device was infected, the attackers were able to execute customized code. Restarting the device or activating Apple’s Lockdown Mode could temporarily eliminate the infection. Kaspersky provided further details, disclosing that the malicious code deployed after infection contained 24 commands, enabling activities such as password extraction from Apple’s Keychain, location monitoring, and file modification or export.

Apple has stated that the issued fixes will safeguard iPhones running iOS 15.7 or earlier, which became outdated in September. Newer versions of the operating system already possess additional security upgrades that render them immune to these particular attacks. Apple also noted that approximately 90 percent of customers who purchased devices within the past four years have updated to iOS 16, the most recent major release.

Kaspersky expressed appreciation towards Apple for collaborating in the analysis and remediation of the vulnerabilities. The cybersecurity company has previously exposed intricate spying tools utilized by the National Security Agency (NSA), including those linked to Stuxnet, which disabled Iranian uranium enrichment facilities. However, Kaspersky faced backlash after U.S. officials claimed that its consumer anti-virus program had facilitated the extraction of classified material from an intelligence employee’s personal computer, resulting in a ban on Kaspersky products on federal machines and a significant decline in its market share in the United States.

The infection technique employed in this recent attack, known as Triangulation, bears similarities to tactics used by NSO and other providers of high-end spyware. NSO has been blacklisted by the White House and other U.S. officials due to its dealings with repressive regimes known for spying on their innocent citizens.