Apple and Security

[krideynyc]

Gotten in, executed, detected, shut down, cleaned. with readily available tools. Been there, done that.

]OK. You and I obviously see this differently. This is not just access. This is more than that. Your next point supports my claim about the level of sophistication implemented.

What puzzles me is how it pushed out that much data, but nothing got alerted. He must have not considered himself a target and had nobody or nothing watching. It’s odd given his financial status, visibility, and the ownership of a far left newspaper. Phones are where it’s at these days for stealing info. People stick everything on them, and pay little attention to locking them down because irs so inconvenient.

The data collection was designed to be as unobtrusive as possible. The entire attack points to a long term data collection of Bezos phone. Not part of any standard off the shelf hacking tool.

 

[Srhsrh]

I’ve been wondering if this is same attack mass marketed
https://www.forbes.com/sites/zakdof...ers-with-malicious-hack-warning/#6c8c5f125245
although I’m skeptical about trusting google to report on Apple vulnerabilities. The security vulnerability was real though. Just not sure about the websites.

 

[krideynyc]

I’ve been wondering if this is same attack mass marketed
https://www.forbes.com/sites/zakdof...ers-with-malicious-hack-warning/#6c8c5f125245
although I’m skeptical about trusting google to report on Apple vulnerabilities. The security vulnerability was real though. Just not sure about the websites.

I'm leaning towards no. So far, Bezos seems to be the only one publicly known to have been hit with this encrypted downloader attack.

 

[Srhsrh]

Well, what Bezos did was unique in terms of telling the world he got hacked. Most important guys cant afford to do that.
https://www.inc.com/jason-aten/14-b...-at-risk-due-to-this-major-security-flaw.html
this is a fun one too, but it is androids and iOS.
I like it for this quote

”The first is that most of what we think of in terms of security for our devices and personal information is more theater than actual protection.”

that’s how I feel about this. People just believe the charade and dumbly trust these devices, then walk around with a device that’s easily compromised, stolen, spied on, lost and has their whole life on it. The little security they do provide gets shut off, because it’s annoying.

 

[krideynyc]

Well, what Bezos did was unique in terms of telling the world he got hacked. Most important guys cant afford to do that.

I'm not counting on those guys to publicly admit they were hacked. I'm counting on the IT Security Industry to report those incidents. In both instances, only one known attack has been documented.

 

[Srhsrh]

I'm not counting on those guys to publicly admit they were hacked. I'm counting on the IT Security Industry to report those incidents. In both instances, only one known attack has been documented.

Oh, I can tell you from working in the business, thousands of attacks occur for every one that gets reported. Legally, it’s not always possible to publish.

 

[krideynyc]

Oh, I can tell you from working in the business, thousands of attacks occur for every one that gets reported. Legally, it’s not always possible to publish.

Well, I will counter that with saying they can mentioned prior similar attacks as long as the details were made public, all maintaining the NDA.

 

[Srhsrh]

Well, I will counter that with saying they can mentioned prior similar attacks as long as the details were made public, all maintaining the NDA.

Well the trick to publishing is being able to recreate the attack in a generic environment normally. And getting your lawyers to approve.

 

[krideynyc]

Well the trick to publishing is being able to recreate the attack in a generic environment normally. And getting your lawyers to approve.

For publishing the results of your research, sure. For general discussion among peers, not necessary.

 

[Srhsrh]

For publishing the results of your research, sure. For general discussion among peers, not necessary.

Hah, Wish you were a lawyer for Microsoft, Google or Apple.

 

[krideynyc]

Hah, Wish you were a lawyer for Microsoft, Google or Apple.

They would say the same thing. As long as the details are already out in the public, they can confirm previous instances of a similar attack without divulging the specific details. FTI and Bezos left the door wide open for anyone in the industry to say if a similar attack has been documented. Even with National Security involved. This isn't a case of a mass general infection. It's an unique and individualized attack. Nothing I've discussed isn't found within the FTI report, or in the public domain.

 

[Srhsrh]

Well, they didn't. And even if they end up dropping it, it gets expensive. I'm not talking about Bezos. He went public. There are situations where neither the infected party or the big tech company wants this out.

 

[krideynyc]

Well, they didn't. And even if they end up dropping it, it gets expensive. I'm not talking about Bezos. He went public. There are situations where neither the infected party or the big tech company wants this out.

And in that case we can't confirm or deny either way. I've been unsuccessfully digging to see if there's any instances of that encrypted downloader, as that has taken some in the industry by surprise.

 

[Srhsrh]

Have you read this?
https://medium.com/@billmarczak/bezos-hack-mbs-mohammed-bin-salman-whatsapp-218e1b4e1242
Notice the sqllite linkage? That's why I think it's all interrelated. I'm sure the file isn't the same as the mentioned Twitter one. I think we're boring everyone else here though. But I certainly haven't clicked on any WeChat or Whatsapp links since I saw this stuff.

 

[krideynyc]

Have you read this?
https://medium.com/@billmarczak/bezos-hack-mbs-mohammed-bin-salman-whatsapp-218e1b4e1242
Notice the sqllite linkage? That's why I think it's all interrelated. I'm sure the file isn't the same as the mentioned Twitter one. I think we're boring everyone else here though. But I certainly haven't clicked on any WeChat or Whatsapp links since I saw this stuff.

I'm fine with ending this discussion, as we've both made our points clear. I'm not pro-Apple or pro-Android. I just understand the Apple side better than most people. And in the grand scheme of things, corporate users will always be less than regular users, so I focus more on that side of IT security. With iPhones falling squarely there.

What I find ironic is that today NY Prosecutors have proof that the leaked texts were sent by Lauren Sanchez to her brother, making her the source of the leaks. Finding out about the malware on his iPhone is just pure coincidence. Still, a lot of data was pushed somewhere out of his phone, for over a year.

 

[Srhsrh]

I'm fine with ending this discussion, as we've both made our points clear. I'm not pro-Apple or pro-Android. I just understand the Apple side better than most people. And in the grand scheme of things, corporate users will always be less than regular users, so I focus more on that side of IT security. With iPhones falling squarely there.

What I find ironic is that today NY Prosecutors have proof that the leaked texts were sent by Lauren Sanchez to her brother, making her the source of the leaks. Finding out about the malware on his iPhone is just pure coincidence. Still, a lot of data was pushed somewhere out of his phone, for over a year.

Yes, I read that, but dont really understand whether what she leaked was everything that got published or whether there's more out there. I only care about the technical side of this. If its just the stupidity of people, its kinda boring to me.

 

[krideynyc]

Yes, I read that, but dont really understand whether what she leaked was everything that got published or whether there's more out there. I only care about the technical side of this. If its just the stupidity of people, its kinda boring to me.

The leaked texts were sold by her brother to the press. But before that was revealed, Bezos suspected his phone was hacked, and thus the whole FTI exercise. Now we know the source of the published leaks, AND that his phone was hacked by someone. The rest has already been discussed.

 

[casualplayer]

I'm glad you 2 have kept this on the forum not PM. You are both very knowledgeable and I for one have enjoyed the conversation and the links you both have shared.
It really is something we all should be concerned with.

 

[kgmspa]

So long as your phone is a turing computer you can and will be hacked. It's the price we all pay for flexability. You want it locked up?

 

[njlefty]

How is it that the Apple operating system for the iPad cannot get hit with malware?

So I'm told, anyway.