Unmasking a 4-Year Covert Operation: A Deep Dive into the Highly Advanced iPhone Exploit Campaign, Triangulation

 By Nadim Kahwaji

 

Apple devices are often considered more secure than their Android counterparts due to the comprehensive security measures they employ, including a tightly controlled app ecosystem, regular software updates, and advanced hardware security features like the Secure Enclave. Although Apple devices benefit from strong security measures, they are not immune to vulnerabilities, as recent incidents have shown. It's essential to remain vigilant and proactive in safeguarding your digital assets.

 

The latest incident, named 'Triangulation,' was uncovered by the security firm Kaspersky after conducting an extensive investigation. The attackers exploited four vulnerabilities, namely CVE-2023-32434, CVE-2023-32435, CVE-2023-38606, and CVE-2023-41990, all of which have since been patched. What makes this attack unique is the utilization of a secret hardware component not typically accessed by the firmware. Kaspersky was unable to ascertain how the attackers became aware of this hidden hardware, adding an intriguing layer of mystery to the incident.

 

Apple incorporates a security feature known as Operating System Integrity (also referred to as System Integrity Protection or SIP in macOS) which is designed to protect the integrity of the operating system and prevent even those with kernel-level access from performing unauthorized modifications. So Even if a user gains kernel-level access, the system protects itself using hardware and software restrictions that prevent unauthorized changes to the operating system and memory, ensuring the integrity and security of the device.

The attacker employs this covert hardware to sidestep this security mechanism. Kaspersky suggests that this hidden hardware is designed for debugging by Apple engineers. Upon uncovering its existence (still a mystery), the attacker manages to input critical data (aimed at deactivating, circumventing, etc., the security mechanism) into the physical destination address of the unknown hardware.

 

Months before this incident, Kaspersky disclosed that Operation Triangulation had compromised its employees' iPhones. Following this, an advisory from the FSB, Russia's Federal Security Service, insinuated that Apple had collaborated with the NSA in these activities. However, Kaspersky researchers have stated they lack any proof to support claims of involvement by either the NSA or Apple.

 Kaspersky supplied this diagram outlining the sequence of the exploit:

 

 

The attack initiated by leveraging CVE-2023-41990, a remote code execution vulnerability in Apple's ADJUST TrueType font instruction. The exploit is delivered through a "zero-click" message, meaning the user does not need to interact with the message for the vulnerability to be exploited, allowing for silent and unnoticed infection The exploit allows attackers to execute code remotely with minimal system privileges, significantly compromising device security. the attacker then capitalizes on CVE-2023-32434, a vulnerability that permits an application to execute arbitrary code with kernel privileges, further escalating their access and control over the system. The unique phase of the attack is identified as CVE-2023-38606, which enables the attacker to bypass previously mentioned security mechanisms by utilizing the unknown hardware components within the device. This represents a sophisticated escalation in the attack chain,

Upon exploiting the discussed vulnerabilities, the attacker gains full control of the device. They then utilize CVE-2023-32435 to execute shellcode, deploying a final spyware payload that harvests sensitive information like microphone recordings and location data. Unmentioned stages involve injecting a payload to erase traces of the exploitation. For comprehensive details, please refer to the full report here.

 

This underscores that no security system is entirely foolproof, the level of sophistication required to breach these defenses typically involves state-level resources and is usually targeted at specific individuals. For the average consumer, the existing protections are robust against the vast majority of threats.