Coming from two sites sent over by Kilo, hackers have successfully attacked iOS devices, including the iPhone, with zeroday attacks compromising login credentials, photos, and other personal data. This is a topic covered extensively with a plan to circumvent the data collection methods in the Privacy, Security and Anonymity (PSA) Course. From arstechnia.com:
The attackers could get a listing of all installed apps on an infected device and make an ad-hoc request to download container directories for any specific apps that weren’t on the list. The attackers could also issue an “allapp” command that would download the container directories for all apps on the device. The malware checked an attacker-controlled server every 60 seconds for commands.
The implant also sent attackers a complete copy of the iOS keychain. The keychain contains a large amount of highly sensitive data, including credentials and certificates used to log into services such as Gmail, Facebook, and countless other services and SSIDs and passwords for all saved Wi-Fi access points. The keychain also contains long-lived tokens used by services such as Google’s iOS Single-Sign-On to enable Google apps to access the user’s account. By uploading this data, the attackers could maintain access to the user’s Google account even once the implant is no longer running.
As noted earlier, the installed implant binary doesn’t survive a reboot, meaning a device will be disinfected as soon as its restarted. It’s not clear if the lack of persistence was intentional or the result of developer limitations. In either case, iPhones can go weeks or longer without being rebooted. By that point, the data obtained likely gave attackers other means to continue surveilling targets of interest.
And from Gizmodo:
“Real users make risk decisions based on the public perception of the security of these devices,” Beers wrote. “The reality remains that security protections will never eliminate the risk of attack if you’re being targeted.”
“To be targeted might mean simply being born in a certain geographic region or being part of a certain ethnic group,” he said. “All that users can do is be conscious of the fact that mass exploitation still exists and behave accordingly; treating their mobile devices as both integral to their modern lives, yet also as devices which when compromised, can upload their every action into a database to potentially be used against them.”
Many, especially some I’ve known who claim to be security ‘experts’ continue a large number of these bad practices such as being attached at the hip to their phones or playing non-stop on social media while telling folks otherwise. As a rule I do not log into any account from a phone, nor do much of anything else aside from critical tasks. Its important to understand that these not just leave you vulnerable but are actively data mining everything about you. And if you thought the idea of ‘red flag’ laws were bad before, just wait until the data mine can pre-predicts your moves…your political affiliations…and your beliefs.
Science fiction is now science fact.