Hackers exploited iOS and Android flaws to infect phones
Summary
Researchers at security firm Sekoia said hackers they assess with moderate to high confidence were linked to Russia’s Foreign Intelligence Service used compromised and impersonated websites to target iPhone and Android users. Injected JavaScript identified visitors’ devices and selected exploit chains that could steal cookies and, in some cases, Wi-Fi passwords and other device data; the flaws had already been patched, so the attacks worked only on outdated software.Key Facts
- The campaign targeted visitors to multiple websites, including an organization’s site marking the 250th anniversary of the signing of the U.S. Constitution.
- Attackers created america250[.]holiday to proxy content from america250.org and add malicious JavaScript.
- Another proxy site impersonated the Raffles of London OWO hotel website.
- The attackers also used compromised websites, including a Ukrainian gas producer’s site, and a Ukrainian web analytics service used by thousands of websites.
- Sekoia identified three delivery methods: JavaScript injected into legitimate website traffic, proxy domains, and a supply-chain compromise of the analytics service.
- The JavaScript profiled visitors’ browsers and devices before selecting from three exploit chains that did not require user interaction.
- One exploit chain was DarkSword, an iOS exploit kit; Sekoia did not name the other two.
- All exploited vulnerabilities had already been patched, and the attacks worked only on outdated iOS or Android versions.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
