As cyberattacks targeting iPhones gradually evolve, users need to be careful. Recently, an attack method using iMessage on the iPhone was discovered, which could cause sensitive information to be stolen secretly as no malicious attachment is displayed to the user. However, this situation can be avoided by keeping iOS up to date, as the main target of the attackers is iOS 16.2.
A global research and analysis team of Kaspersky, a security company, introduced an attack technique called Operation Triangulation on Thursday. Triangulation attack by hackers is a technique that bypasses hardware-based security by connecting four security vulnerabilities of the iPhone. It is also called the zero-click method because it can infect target devices without downloading a specific app or clicking on a link.
Attackers exploit an iPhone security vulnerability to distribute attachments containing malicious codes to victims as iMessages, and the malicious codes are executed immediately without informing users that such messages have been sent. When malicious codes are installed, sensitive information such as audio recordings, photos, and geographic locations is collected and data is transmitted to a remote server. It has also been confirmed that it exposes vulnerabilities in Safari, the iPhone’s Internet browser, to erase traces of penetration.
According to Kaspersky’s analysis, the attack has been going on since 2019, which is the most complex form of security vulnerability Apple is facing. Hackers have left thousands of iPhones with highly secretive back doors – malicious software that disables the normal authentication process to access the system – for more than four years, gaining the highest level of access to the iPhone themselves. Successful use of the backdoor requires a comprehensive and careful understanding of Apple’s product’s mechanisms, pointing out that the serious problem lies in exactly how hackers use the mechanism and where they found the information.
Due to its closed nature, iOS does not have a standard operating system that can detect and eliminate malware even if a smartphone is infected. “The multi-level attacks are developing extremely well,” Kaspersky said. “It is unprecedented for a campaign targeting iOS-based devices to develop to this extent.” “Because iOS is such a closed environment, it is very difficult for attackers to determine when they secretly penetrated using features that no one knows,” he said.
“We are finalizing the analysis of this attack,” he said. “We are investigating further traces of the hardware they used in the process of bypassing Apple’s hardware-based security.”
SALLY
ASIA JOURNAL
