On Wednesday, Apple announced that it successfully addressed two recently discovered security vulnerabilities in its iPhones and iPads. These flaws had been exploited to hack numerous devices in Russia, underscoring the critical nature of a hacking operation that Russian intelligence has attributed to the United States. This revelation not only highlights the ongoing cybersecurity challenges faced by major tech companies but also raises questions about the implications for user privacy and data security in an increasingly digital world.

Apple credited the discovery of these vulnerabilities to researchers from Kaspersky Lab, a prominent Russian cybersecurity firm, which reported three weeks earlier that its senior employees were targeted in the attack. Concurrently, Russia’s Federal Security Service (FSB) accused the National Security Agency (NSA) of orchestrating the operation, although it did not provide any evidence to support this claim. The NSA has not publicly responded to requests for comment, further fueling speculation about the origin of these cyber threats and the potential for international cybersecurity tensions.

Russia claims countless iPhones were hacked, criticizes U.S. and Apple

Kaspersky previously stated that the hacking method involved sending an iMessage embedded with a malicious attachment. This method allowed attackers to compromise the user’s phone without any interaction, enabling them to execute arbitrary code remotely. The malware would temporarily disappear upon restarting the device, a behavior that experts suggest signifies the importance of regularly rebooting phones as a precautionary measure. Additionally, Apple’s optional Lockdown Mode effectively mitigated these types of attacks, showcasing the importance of user awareness and proactive security measures.

On the same day, Kaspersky provided further details, revealing that the malicious code executed a series of 24 commands after infection. These commands included extracting passwords from Apple’s Keychain, tracking locations, and modifying or exporting files. Such sophisticated tactics highlight the evolving nature of cyber threats and the need for robust security protocols that can adapt to new methods employed by cybercriminals.

“As we delved into the attack, we discovered a sophisticated iOS implant that displayed numerous intriguing oddities,” stated Kaspersky’s Georgy Kucherin, one of three researchers acknowledged by Apple for identifying the vulnerabilities. Kaspersky has dubbed the attack method Triangulation and has released tools that help users verify whether their devices have been compromised, reflecting the ongoing battle against cyber threats and the critical need for user vigilance in digital security.

Apple announced that the latest updates would secure iPhones operating on iOS 15.7 or earlier, which has been outdated since September. Users with more recent versions of the operating system benefit from additional enhancements that render them immune to such attacks. Apple reported that 90% of customers who purchased devices in the last four years have upgraded to iOS 16, the most recent significant release, illustrating the importance of keeping software up-to-date to safeguard against potential vulnerabilities.

Kaspersky expressed gratitude to Apple for collaborating in the investigation and resolution of these vulnerabilities, emphasizing the essential partnership between technology companies and cybersecurity experts in the fight against cyber threats. This collaboration is vital for enhancing security measures and protecting users from increasingly sophisticated attacks.

In previous investigations, Kaspersky has uncovered several advanced spying tools believed to be developed by the NSA, including those related to Stuxnet, which famously disrupted Iranian uranium enrichment processes. These revelations raise critical discussions about the ethics of surveillance technology and its implications for global cybersecurity.

U.S. officials later indicated that Kaspersky’s antivirus software had been utilized to extract classified information from a government employee’s computer. As a result, Kaspersky faced restrictions on government devices, leading to a decline in its market share in the United States. This event highlights the intricate relationship between cybersecurity companies and government regulations in maintaining national security.

The infection technique employed in the Triangulation attack bears resemblance to methods used by NSO and other vendors of high-end spyware. The White House and various U.S. authorities have since blacklisted NSO for allegedly supplying oppressive governments that misuse such tools to surveil innocent individuals, underscoring the ongoing challenges in regulating the cybersecurity landscape and protecting civil liberties.