A newly discovered iPhone exploit chains multiple zero-day vulnerabilities to hit both the iOS kernel and hardware-firmware, active for over four years. Once nation-states develop these expensive attacks, the code leaks to criminals and terrorists, threatening critical infrastructure and everyday users alike.
Chapters
One of the most impressive hacks has recently been uncovered. It impacts iPhones and it may be the most advanced exploit ever seen. Now, many are saying that everyday people should not be worried as not many phones are currently being targeted, but that is absolutely wrong. Let's do a quick overview of the attack, but more importantly, Let's discuss why we all should be worried. The basics of this attack, well, they're pretty impressive. It totally compromised the security of iPhones, which traditionally have been pretty safe, and has likely been going on for over 4 years. Multiple zero-day vulnerabilities were chained together as part of this novel attack. And the iOS kernel and the device chipset, which is a combination of hardware and firmware, were compromised. Now, this attack is difficult to detect. It's also difficult to evict, and it has likely been active for some time. Now, unfortunately, I am hearing many people, including experts, breathe a sigh of relief in saying these attacks aren't widespread. Just against important or nation-level targets and that everyday people shouldn't be concerned. That is wrong. Although the discovery of zero days and the development of exploits are massively expensive, that work is now done in this case. Once the attacker launched it, essentially putting it out into the wild, everyone is able to reach out there and grab these vulnerabilities and exploits, reverse engineer engineer and dissect them and then use the interesting parts in their own malware and attack campaigns. This is the new model for cybercriminals, data harvesters, digital terrorists, and all other sorts of miscreants out there trying to do harm. Let powerful nations invest and do the— have all that heavy lifting and then just reuse what they did. The downstream risk effects from all these attackers using this novel code, these very expensive and elite zero days, well, that can impact everyone. If this is a nation-state and they are attacking their enemy, they are probably going to target critical infrastructures of that enemy as well, including supply chains. You and I rely on those services such as the electrical grid, food distribution, communications, transportation, commercial shipping, uh, fuel supply and distribution. And let's not forget about healthcare and our finance systems. If any of these are targeted, we can become impacted. Lastly, We should be worried as this is the future trend. This exploit was tough to detect and we don't know how many other such attacks are ongoing. It is reasonable to think that if this threat agent developed an exploit for iOS iPhones, it probably did the same for Android devices, but only time will tell. The fact is nation-states have the resources and the desire to develop these types of attacks. And all of this ties into what I've been saying in my annual predictions. This trend is not going away, but will only get stronger. At the end of the day, we should all be worried how these vulnerabilities and exploits manifest against individuals and organizations. Make no mistake, we all carry the risk. If you want more cybersecurity insights, be sure to like and subscribe.
