Incident: Google Discovers Long-Term iPhone Hacking Campaign.

Published Date: 2019-08-29

Postmortem Analysis
Timeline 1. The software failure incident of hacking iPhones using malicious websites was discovered by Google's Project Zero team and was ongoing for at least two years [88410]. 2. The software failure incident of hacking iPhones through malware-infected websites was discovered by Google's security researchers and had been active for at least two years [88413].
System 1. iOS operating system versions from iOS 10 through to the latest version of iOS 12 failed [88410, 88413]. 2. Safari web browser on Apple products failed [88410, 88413].
Responsible Organization 1. The software failure incident was caused by hackers using websites with malware to exploit vulnerabilities in Apple's software to hack iPhones [88410, 88413]. 2. The hackers behind the incident were not specifically identified, but the attacks were suspected to have possible ties to China and were targeting the Uighur community [89536].
Impacted Organization 1. Apple users were impacted by the software failure incident [131118, 88410, 89536]. 2. iPhone users, including those who visited specific websites, were affected by the hacking incident [88410, 88413]. 3. Individuals using iPhones, iPads, and Macs were advised to update their devices to protect against security vulnerabilities [131118]. 4. Users of Apple devices, specifically iPhones, were targeted by the malware implanted through certain websites [88410]. 5. People in certain communities, such as the Uighur community, were targeted by the attack on iPhones [89536].
Software Causes 1. The software failure incident was caused by a series of security vulnerabilities in Apple's software that allowed hackers to exploit iPhones when users visited certain websites [88410, 88413]. 2. The vulnerabilities included bugs within Safari, the default web browser on Apple products, which were used by attackers to compromise devices [88410, 88413]. 3. The malware implanted through the security flaws could gain full control of the device, steal photos, messages, location data, and access data from various apps like Instagram, WhatsApp, and Gmail [88410, 88413]. 4. The attackers exploited almost every version of iOS from iOS 10 through the latest version of iOS 12, indicating a sustained effort to hack iPhone users over at least two years [88410, 88413].
Non-software Causes 1. The failure incident reported in the news articles was caused by a sustained effort by hackers to exploit vulnerabilities in Apple devices, specifically iPhones, over a period of at least two years [Article 129084, Article 88090, Article 88410, Article 88413]. 2. The hackers used websites with malware that discreetly implanted malicious software on iPhones when users visited these compromised sites, allowing the attackers to gain full control over the devices and access sensitive information such as contacts, photos, location data, and data from various apps [Article 88410, Article 88413]. 3. The attack affected a specific community, namely the Uighur community, with fewer than a dozen websites focusing on content related to the Uighur community being targeted by the malware [Article 89536]. 4. The vulnerabilities exploited by the hackers were present in the iPhone software from iOS 10 through to the latest version of iOS 12, indicating a sustained effort by the attackers to target users over a significant period of time [Article 88413].
Impacts 1. The spyware incident involving RCS Lab and the Italian and Kazakhstani governments led to the compromise of private messages, contacts, browser activities, camera, address book, clipboard, and chat apps on citizens' smartphones [129084]. 2. The spyware incident targeting iPhones through malicious websites allowed attackers to gain full control over the devices, steal contacts, images, location data, and data from various apps like iMessage, WhatsApp, Telegram, Gmail, and Google Hangouts [88376]. 3. The malware attack on iPhones through certain websites affected fewer than a dozen websites related to the Uighur community, allowing attackers to gain full control over the devices and steal sensitive data [89536]. 4. The malware attack on iPhones through malicious websites exploited 12 separate security flaws, most of which were in Safari, the default web browser on Apple products, allowing attackers to compromise devices running almost every version from iOS 10 through the latest version of iOS 12 [88410]. 5. The malware attack on iPhones through hacked websites allowed attackers to monitor all activities on the devices, access personal data, and potentially install additional malicious apps, posing a significant threat to user privacy and security [88413].
Preventions 1. **Timely Software Updates**: Updating the devices with the latest software patches could have prevented the software failure incident by fixing the vulnerabilities exploited by the attackers [#89536, #88410]. 2. **Improved Security Measures**: Implementing enhanced security measures within the operating system, such as stronger sandboxing mechanisms and improved browser security, could have made it more difficult for the attackers to exploit the system [#88410, #88413]. 3. **Regular Security Audits**: Conducting regular security audits and vulnerability assessments could have helped in identifying and addressing the security flaws before they were exploited by malicious actors [#88413]. 4. **User Awareness and Education**: Educating users about the risks of visiting suspicious websites and the importance of updating their devices regularly could have prevented them from falling victim to the attack [#88413]. 5. **Collaboration and Information Sharing**: Enhanced collaboration between tech companies like Google and Apple in sharing information about security vulnerabilities could have led to quicker identification and patching of the flaws, preventing widespread exploitation [#88410, #88413].
Fixes 1. Apple issued a software fix to address the vulnerabilities that allowed the hacking of iPhones by visiting certain websites [88410]. 2. Users of iPhones, iPads, and Macs were advised to immediately update their devices to protect against the security vulnerabilities [131118]. 3. Google's Project Zero team notified Apple of the vulnerabilities, prompting Apple to release a patch to close the security holes [88410]. 4. Apple released software updates to address the flaws in the kernel and WebKit, which could allow attackers to take complete control of Apple devices [131118]. 5. Apple fixed the vulnerabilities in question quickly after being informed by Google, demonstrating a proactive response to the security incident [89536].
References 1. Google's Project Zero [129084, 88376, 88410, 89536, 88413] 2. Apple [129084, 88090, 131118, 89536] 3. Security researchers [88410, 88413] 4. Rachel Tobac, CEO of SocialProof Security [131118] 5. Volexity [89536] 6. Chinese embassy [89536] 7. Reuters [89536] 8. TechCrunch [89536] 9. Ian Beer [88410, 88413] 10. Tim Cook [89536]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - Google's Project Zero discovered a sustained effort to hack iPhones over a period of at least two years, where malicious software was implanted through websites to gather data [Article 88410]. - Google's Project Zero also found evidence of a sustained effort to hack large numbers of iPhones over a period of at least two years, using websites to implant malicious software [Article 88090]. - The attack affected all models of iPhone, and the implant could access a vast amount of data, including contacts, images, and GPS location data [Article 88410]. (b) The software failure incident having happened again at multiple_organization: - Google's Project Zero revealed a string of security flaws that allowed for the hacking of any iPhones used to visit certain websites laced with malware, affecting fewer than a dozen websites focusing on content related to the Uighur community [Article 89536]. - Sophisticated hackers used flaws in macOS and iOS to install malware on Apple devices visiting Hong Kong-based media and pro-democracy websites, indicating a broad campaign of iPhone hacking [Article 121088].
Phase (Design/Operation) design, operation (a) In the software failure incident related to the hacking of iPhones through malicious websites, the incident can be attributed to contributing factors introduced during the design phase. Google's Project Zero discovered multiple websites with malware that exploited security flaws in Apple's software to hack iPhones when users visited these sites [88410]. The attack affected all models of iPhones, including the latest version, indicating a sustained effort to hack users over at least two years [88413]. (b) The software failure incident can also be linked to contributing factors introduced during the operation phase. The malware implanted through the malicious websites had the ability to gain full control of iPhones, stealing photos, messages, location data, and more, once a user visited a compromised page [88410]. The implant could access an extensive amount of data and relay it back to an external server every 60 seconds, indicating active operation and data exfiltration [88413].
Boundary (Internal/External) within_system, outside_system (a) within_system: - The software failure incident involving the hacking of iPhones through malicious websites was a result of vulnerabilities within the iOS operating system and Safari browser [88410]. - Google's Project Zero team discovered multiple security flaws within Apple's software that allowed for the hacking of iPhones when users visited specific websites [89536]. - The attack exploited 12 separate security flaws, most of which were within the Safari browser, allowing the implantation of malware to gather data from the devices [88410]. - The malware installed on iPhones could access a wide range of data, including contacts, images, location data, and information from various apps like Instagram, WhatsApp, and Gmail [88410]. - Apple released a software fix in response to the vulnerabilities identified by Google, indicating that the failure originated from within the iOS and Safari systems [88410]. (b) outside_system: - The attack on iPhones through malicious websites was not a broad-based exploit but was narrowly focused on specific websites related to the Uighur community, indicating an external targeting factor [89536]. - The attack affected fewer than a dozen websites focusing on content related to the Uighur community, suggesting an external influence on the selection of targeted websites [89536]. - The Chinese government's forceful efforts against the Uighur Muslim population and the use of technology in human rights abuses could be considered an external factor influencing the specific targeting of these websites [89536].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident involving the hacking of iPhones by exploiting vulnerabilities in Apple's software was carried out through websites discreetly implanting malicious software without human participation [Article 88410]. - Google's Project Zero team discovered websites with malware that could hack iPhones by exploiting security flaws, affecting fewer than a dozen websites focused on content related to the Uighur community [Article 89536]. - The malware implanted through these websites could gain full control of iPhones, steal photos, messages, location data, and install more malicious apps [Article 89536]. (b) The software failure incident occurring due to human actions: - The attack on iPhones through malicious websites was a result of human actions, where attackers used 12 separate security flaws to compromise devices, with most bugs within Safari, the default web browser on Apple products [Article 88410]. - The attack was shared in detail by Google's Project Zero team, revealing that the malware-infected websites had been hacking iPhones for at least two years, indicating a sustained effort by attackers [Article 88410]. - The malware implanted through the websites could access an extensive amount of data, including contacts, images, GPS location data, and data from various apps used by iPhone users [Article 88410].
Dimension (Hardware/Software) software (a) The software failure incident occurring due to hardware: - There is no information in the provided articles about the software failure incident occurring due to contributing factors originating in hardware. (b) The software failure incident occurring due to software: - The software failure incident reported in the articles is due to software vulnerabilities that allowed hackers to exploit iPhones by visiting certain websites containing malware [Article 88410]. - Google's Project Zero security researchers discovered multiple websites with malware that could hack iPhones, exploiting security flaws in Apple's software [Article 89536]. - The attack affected all models of iPhone, and the malware could gain full control of the device, stealing photos, messages, location data, and more [Article 88410]. - The malware was able to access an extensive amount of data, including contacts, images, GPS location data, and information from various apps like Instagram, WhatsApp, and Gmail [Article 88410]. - The vulnerabilities exploited by the attackers were present in iOS versions from iOS 10 through the latest version of iOS 12, indicating a sustained effort to hack iPhone users over at least two years [Article 88410]. - Apple issued a software fix to address the security flaws after being notified by Google, and users were advised to update their devices to the latest software version for protection [Article 88410]. - The attack was described as a sophisticated and narrowly focused effort, affecting fewer than a dozen websites related to the Uighur community [Article 89536]. - The malware was active for about two months, targeting websites focused on content related to the Uighur community, and the attack was not a broad-based exploit of iPhones en masse [Article 89536].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident reported in the articles is malicious in nature. Google's Project Zero team discovered a sustained effort to hack iPhones over a period of at least two years through websites that discreetly implanted malicious software to gather contacts, images, and other data [Article 88410]. The attack was not targeted but affected all models of iPhones, indicating a group making a sustained effort to hack users in certain communities [Article 88410]. The malware installed on the iPhones could access a significant amount of data, including contacts, images, GPS location data, and data from various apps like Instagram, WhatsApp, and Gmail [Article 88410]. The attackers exploited multiple vulnerabilities to compromise devices, with most bugs found within Safari, the default web browser on Apple products [Article 88410]. Additionally, the attack affected fewer than a dozen websites focusing on content related to the Uighur community, indicating a targeted approach towards this specific group [Article 89536]. The malware was able to gain full control of the devices, steal photos, messages, location data, and install more malicious apps, as well as harvest passwords and encrypted messages [Article 89536]. These details point towards a malicious software failure incident with the intent to harm the system and compromise user data. (b) The software failure incident reported in the articles is non-malicious in nature. There are no instances or indications of unintentional software failures or system vulnerabilities introduced without the intent to harm the system.
Intent (Poor/Accidental Decisions) unknown (a) The intent of the software failure incident was not due to poor decisions or intentional actions. The incident involved a sustained effort by hackers to exploit vulnerabilities in Apple devices, particularly iPhones, through malicious websites. The attack was indiscriminate, affecting anyone who visited the compromised sites, and the malware installed on the devices allowed for extensive data collection without the users' knowledge [88410]. (b) The software failure incident was not a result of accidental decisions or unintended actions. It was a deliberate and targeted attack by hackers who exploited security flaws in Apple devices, specifically iPhones, over a period of at least two years. The attackers used sophisticated methods to implant malware through certain websites, enabling them to gain full control of the devices and access sensitive information such as contacts, photos, and location data [88410].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident occurring due to development incompetence: - The incident of hacking iPhones through malicious websites exploiting Apple software vulnerabilities was a result of a sustained effort by attackers over at least two years, targeting specific communities like the Uighur population [Article 88410]. - The attackers used a series of security flaws, including bugs within Safari, to compromise devices and gain full control, accessing sensitive data like contacts, images, and location information [Article 88410]. - The attack was not a broad-based exploit but narrowly focused on specific websites related to the Uighur community, indicating a targeted effort [Article 89536]. (b) The software failure incident occurring accidentally: - The incident involved websites discreetly implanting malicious software on iPhones, leading to the compromise of devices and the extraction of various data without the users' knowledge [Article 88410]. - The malware was installed when users visited specific pages, indicating an accidental exposure to the malicious software [Article 88410]. - The attack was not a broad-based exploit but narrowly focused on specific websites related to the Uighur community, indicating a targeted effort rather than accidental exposure [Article 89536].
Duration temporary The software failure incident related to the hacking of iPhones by exploiting vulnerabilities in Apple's software was temporary. The attack lasted for at least two years, as discovered by Google's Project Zero team [Article 88410]. The malware was active for only two months, affecting fewer than a dozen websites related to the Uighur community [Article 89536]. The vulnerabilities were fixed by Apple in February, indicating a temporary nature of the incident [Article 89536].
Behaviour crash, omission, timing, value, other (a) crash: The software failure incident related to the spyware used by foreign governments to hack into Apple and Android phones can be categorized as a crash. The spyware was designed to steal information from devices, leading to a loss of control over the devices' functions and potentially causing them to crash or malfunction [129084]. (b) omission: The software failure incident involving the hacking of iPhones by exploiting security flaws can be considered an omission failure. The malware implanted through certain websites omitted to perform the intended functions of protecting user data and privacy, instead gathering sensitive information without user consent [88410]. (c) timing: The software failure incident related to the hacking of iPhones by exploiting vulnerabilities can be associated with a timing failure. The malware installed on the devices may have caused delays in the normal functioning of the devices by continuously transmitting data to external servers every 60 seconds, affecting the timing of data processing and communication [88413]. (d) value: The software failure incident involving the hacking of iPhones through malicious websites can be linked to a value failure. The malware gained full control over the devices, allowing attackers to access valuable data such as contacts, images, location information, and sensitive app data, compromising the integrity and confidentiality of user information [88410]. (e) byzantine: The software failure incident related to the spyware used by foreign governments to hack into phones does not exhibit characteristics of a byzantine failure, as there is no mention of inconsistent responses or interactions in the articles. (f) other: The software failure incident involving the hacking of iPhones through malware can be described as a security breach. The incident resulted in unauthorized access to user data, compromising the security and privacy of individuals using the affected devices [89536].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human (a) death: There were no reports of people losing their lives due to the software failure incident in the articles. (b) harm: The software failure incident did not result in physical harm to individuals as reported in the articles. (c) basic: The software failure incident did not impact people's access to food or shelter as reported in the articles. (d) property: The software failure incident did impact people's material goods, money, or data. The malware installed on iPhones could access personal data such as contacts, photos, location, and app information [Article 88410]. (e) delay: There were no reports of people having to postpone activities due to the software failure incident in the articles. (f) non-human: Non-human entities, such as iPhones and Macs, were impacted by the software failure incident. The malware targeted Apple devices, specifically iPhones, to gather data and compromise user privacy [Article 88410]. (g) no_consequence: The software failure incident did have real observed consequences, such as compromising user data and privacy, as reported in the articles. (h) theoretical_consequence: The articles did discuss potential consequences of the software failure, such as the ability of attackers to gain full control of devices, steal data, and execute arbitrary code, but these consequences did occur in reality [Article 88410]. (i) other: There were no other consequences of the software failure incident mentioned in the articles.
Domain information (a) The software failure incident was related to the information industry, specifically affecting Apple devices such as iPhones and Macs, which are widely used for communication, data storage, and accessing online content [Article 129084, Article 88376, Article 88090, Article 131118, Article 89536, Article 88410, Article 88413]. (b) Not directly related to transportation. (c) Not directly related to natural resources. (d) Not directly related to sales. (e) Not directly related to construction. (f) Not directly related to manufacturing. (g) Not directly related to utilities. (h) Not directly related to finance. (i) Not directly related to knowledge. (j) Not directly related to health. (k) Not directly related to entertainment. (l) Not directly related to government. (m) The software failure incident was not directly related to any other industry.

Sources

Back to List