“The security of iOS, once breached, makes it really difficult to detect these attacks,” said Wardle, a former NSA employee. At the same time, he added that attackers will need to assume that any blatant campaign against Kaspersky will eventually be detected. “In my opinion, this would be sloppy for an NSA attack,” he said. “But it does show that hacking Kaspersky is extremely valuable to an attacker or anyone who does this could have another iOS zero day. If you only have one exploit, then you wouldn’t risk your single iOS remote attack to hack Kaspersky.”
The NSA declined WIRED’s request for comment on the FSB’s announcement or Kaspersky’s results.
with iOS 16 release In September 2022, Apple introduced a special security setting for the mobile operating system called Locked Mode, which intentionally restricts usability and access to potentially vulnerable features. loopholes in services like iMessage and Apple’s WebKit. It is not known whether Lock Mode prevents attacks observed by Kaspersky.
The fact that the Russian government intentionally discovered Apple’s collusion with US intelligence “demonstrates the close cooperation of the American company Apple with the national intelligence community, in particular the US NSA, and confirms that the stated policy to ensure the security of the user’s personal data of Apple Devices is not true,” the statement said. a statement by the FSBadded that it would allow the NSA and “partners in anti-Russian operations” to target “any person of interest to the White House,” as well as U.S. citizens.
The FSB statement did not include any technical details of the described NSA spying campaign or any evidence that Apple colluded in it.
Apple has historically resisted pressure to provide a “backdoor” or other vulnerability to US intelligence or law enforcement agencies. That stance has been expressed most openly in Apple’s 2016 high-profile confrontation with the FBI about the office asking Apple to assist in decoding the iPhone used by the San Bernadino mass shooter Syed Rizwan Farook. The deadlock ended only when the FBI found a method to access the iPhone’s memory with the help of Australian cybersecurity company Azimuth.
Although the announcement came on the same day as the FSB’s statement, Kaspersky has so far made no statement that the Operation Triangulation hackers targeting the company are working for the NSA. The cybersecurity company also did not attribute the attack to Equation Group, Kaspersky’s name for state-sponsored hackers that it has previously associated with highly sophisticated malware, including Stuxnet and Duqu, tools widely believed to have been created and deployed by the NSA and its allies. .
Kaspersky said in a statement to WIRED that, “Given the sophistication of the cyber espionage campaign and the complexity of analyzing the iOS platform, further research will certainly reveal more details on this matter. .”
US intelligence agencies and its allies will, of course, have plenty of reasons to want to look over Kaspersky’s shoulder. Beyond the years Warning from the US government that Kaspersky has ties to the Russian government, the company’s researchers have long expressed their willingness track and expose hacking campaign conducted by Western governments which Western cybersecurity companies do not. In fact, back in 2015, Kaspersky revealed that its private network has been compromised by hackers who used a variant of the Duqu malware, suggesting a link to the Equation Group—and thus potentially the NSA.
That history, combined with the sophistication of the malware targeting Kaspersky, shows that no matter how wild the FSB’s claims may be, there is good reason to imagine that Kaspersky’s intruders may have ties to the government. But if you hack one of the world’s most heavily government-funded hacker-tracking tools—even with seamless, hard-to-detect iPhone malware—you could be caught sooner or later.
