To use this site, please disable the ad blocking feature and reload the page.
This website uses cookies to collect information about your visit for purposes such as showing you personalized ads and content, and analyzing our website traffic. By clicking “Accept all,” you will allow the use of these cookies.
Users accessing this site from EEA countries and UK are unable to view this site without your consent. We apologize for any inconvenience caused.
REUTERS/Andrew Kelly Signage is seen at the Apple Fifth Avenue store for the release of the Apple iPhone 14 range in Manhattan, New York City, U.S., September 16, 2022.
The Washington Post / Joseph Menn
12:35 JST, June 22, 2023
Apple on Wednesday said it had fixed two newly discovered security flaws in its iPhones and iPads that had been used to hack thousands of devices in Russia, underscoring the seriousness of a campaign that Russian intelligence blamed on the United States.
Apple credited the discovery of the flaws to researchers from Russian security software maker Kaspersky Lab, which said three weeks ago that its senior employees were among those targeted. At the same time as Kaspersky’s initial announcement, Russia’s Federal Security Service, known as the FSB, accused the National Security Agency of being responsible. It did not provide evidence or explain how it reached that conclusion. The NSA did not respond to a request for comment.
Kaspersky said previously that the attack worked by sending an iMessage with a malicious attachment. Without ever seeing that message, the phone’s user would be infected and the attacker could run code of their choosing. The infection would disappear when users turned their phones off and on again, which experts say consumers should do at regular intervals. Apple’s optional Lockdown Mode also blocked the attacks.
On Wednesday, Kaspersky gave more detail, saying that the malicious code installed after infection had 24 commands, including extracting passwords from Apple’s Keychain, monitoring locations, and modifying or exporting files.
“As we delved into the attack, we discovered a sophisticated iOS implant that displayed numerous intriguing oddities,” said Kaspersky’s Georgy Kucherin, one of three credited by Apple with discovering the vulnerabilities. Kaspersky dubbed the attack Triangulation, and it and others have released tools to check if devices are infected.
Apple said the fixes would protect iPhones running iOS 15.7 or earlier, which became out of date in September. More recent versions of the operating system had other improvements that made them impervious to the attacks. Apple said 90 percent of customers who bought devices in the past four years have updated to iOS 16, the latest major release.
Kaspersky thanked Apple for working with it to analyze and repair the flaws.
Kaspersky in the past has exposed a number of the most sophisticated spying tools the NSA is known to have worked on, including some related to Stuxnet, which disabled Iranian uranium enrichment tools.
U.S. officials later said that Kaspersky’s consumer anti-virus program had been used to extract classified material from an intelligence employee’s home computer. Kaspersky was banned from federal machines, and its share of the U.S. market plummeted.
The infection technique used in Triangulation is similar to that used by NSO and other vendors of high-end spyware. The White House and other U.S. officials have blacklisted NSO for dealing with repressive governments that then spied on innocent citizens.
