A 37C3 talk by Kaspersky researchers on Operation Triangulation, a zero-click iPhone attack that targeted their own colleagues. They describe capturing every stage of the chain, four zero-days and a previously unknown spyware active for years.
Why Hacker News points people here: HN recommends it as a gripping look at what nation-state attackers can do, used as the primary source in threads about iPhone security and Kaspersky.
“was a rollercoaster of a ride. If you have the time to watch it I highly recommend it!”HN comment, 2024
“was a rollercoaster of a ride. If you have the time to watch it I highly recommend it!”
Talk on discovering a zero-click attack chain with four zero-days.
Full comment
Kaspersky is a really talented group. Their talk at CCC about discovering a zero-click attack, managing to capture all the stages of the attack, finding four zero day vulnerabilities and discovering a previously unknown spyware that was there for years was a rollercoaster of a ride. If you have the time to watch it I highly recommend it! [1]: this video
RecommendsbrokenmachineOct 2024
“Absolutely insane attack. Really opens your eyes on what nation-state attackers are capable of.”
Shows what nation-state attackers are capable of.
Full comment
Relevant: 37C3 - Operation Triangulation: What You Get When Attack iPhones of Researchers this video Absolutely insane attack. Really opens your eyes on what nation-state attackers are capable of.
Cites ituicompatFeb 2024
“using svg rendering as an attack vector was where the name”
Explains origin of Operation Triangulation name via SVG fingerprinting.
Full comment
I know you’re implying the js specifically but using svg rendering as an attack vector was where the name “operation triangulation” came from with the recent high profile exploit. They would draw a triangle and then hash the result to get a detailed bowser fingerprint of the victims machine. this video
Cites itWonderingMaryFeb 2024
“the most recent hack against the iPhone of one of the executives of the russian cybersecurity company Kaspersky”
Cited as source for the iPhone hack against Kaspersky executives.
Full comment
Pegasus is only the malware that has the spying capabilities (file upload, download and command execution...etc). it usually infects the intended target using an exploit (0-day) that doesnt have a fix, if you're asking if there are 0days that can hack modern iPhones, the answer is most likely yes, given the most recent hack against the iPhone of one of the executives of the russian cybersecurity company Kaspersky [1]. [1] this video
Cites itperching_aixNov 2024
“A high-profile example would be Kaspersky catching a sophisticated data exfiltration campaign at their own headquarters”
Example of Kaspersky catching a sophisticated exfiltration campaign via traffic monitoring.
Full comment
Network traffic monitoring is routinely done at enterprises. It's usually part-automated using the typical approaches (rules and AI), and part-manual (via a dedicated SOC team). There are actual compromises caught this way too, it's not (entirely) just for show. A high-profile example would be Kaspersky catching a sophisticated data exfiltration campaign at their own headquarters: this video So it is definitely possible, just maybe not how you imagine it being done.
