Pierluigi Paganini September 07, 2019

Apple replied to Google about the recent report suggesting iPhones may have been hacked as part of a long-running hacking campaign.

Apple criticized the report recently published by Google that claims that iPhones may have been hacked by threat actors as part of a long-running hacking campaign. Apple defines the report as inaccurate and misleading.

At the end of August, researchers at Google Project Zero published an analysis that claims it was possible to hack iPhone devices by visiting specially crafted websites.

Earlier this year, Google Threat Analysis Group (TAG) experts uncovered an iPhone hacking campaign, initially, they spotted a limited number of hacked websites used in watering hole attacks against iPhone users.

“Earlier this year Google’s Threat Analysis Group (TAG) discovered a small collection of hacked websites. The hacked sites were being used in indiscriminate watering hole attacks against their visitors, using iPhone 0-day.” reads the report published by Google. 

“There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant. We estimate that these sites receive thousands of visitors per week.” 

According to Google, threat actors used at least five unique iPhone exploit chains that allowed them to remotely jailbreak a device and deliver spyware. The attackers targeted devices running from iOS 10 through to iOS 12.

According to Apple spokesman Fred Sainz, the report published by Google created a “false impression” that the hacking campaign may have been compromised a large number of iPhones.

Sainz explained that the campaign was highly targeted and affected fewer than a dozen websites that focus on content related to the Uighur ethnic minority in China.

“First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones “en masse” as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community. Regardless of the scale of the attack, we take the safety and security of all users extremely seriously.” Sainz wrote.”Google’s post, issued six months after iOS patches were released, creates the false impression of “mass exploitation” to “monitor the private activities of entire populations in real time,” stoking fear among all iPhone users that their devices had been compromised. This was never the case.”

According to Apple the hacking operation uncovered by Google lasted some months and not years as reported in Google’s research

Sainz pointed out that the website used to carry out watering hole attacks were operational for roughly two months, not two years as Google reported. 

“Second, all evidence indicates that these website attacks were only operational for a brief period, roughly two months, not “two years” as Google implies.” added Sainz. “We fixed the vulnerabilities in question in February — working extremely quickly to resolve the issue just 10 days after we learned about it. When Google approached us, we were already in the process of fixing the exploited bugs.”

Apple remarked the importance of protecting its customers.

Pierluigi Paganini

(SecurityAffairs – Apple, iPhone)

[adrotate banner=”5″]

[adrotate banner=”13″]