Hackers Used Local News Sites to Install Spyware On iPhones

A newly discovered watering-hole campaign is targeting Apple
iPhone users in Hong Kong by using malicious website links as a
lure to install spyware on the devices.

According to research published by Trend
Micro^[1] and Kaspersky^[2], the “Operation
Poisoned News” attack leverages a remote iOS exploit chain to
deploy a feature-rich implant called ‘LightSpy’ through links to
local news websites, which when clicked, executes the malware
payload and allows an interloper to exfiltrate sensitive data from
the affected device and even take full control.

Watering-hole attacks typically let a bad actor compromise a
specific group of end-users by infecting websites that they are
known to visit, with an intention to gain access to the victim’s
device and load it with malware.

The APT group, dubbed “TwoSail Junk” by Kaspersky, is said to be
leveraging vulnerabilities present in iOS 12.1 and 12.2 spanning
all models from iPhone 6 to the iPhone X, with the attacks first
identified on January 10, before intensifying around February 18.

Using Malicious Links as Bait to Install Spyware

The campaign uses fake links posted on multiple forums, all popular
with Hong Kong residents, that claim to lead to various news
stories related to topics that are either sex-related, clickbait,
or news related to the ongoing COVID-19
coronavirus pandemic.

Clicking the URLs lead the users to legitimate news outlets that
have been compromised as well as websites set up specifically for
this campaign (e.g.,
hxxps://appledaily.googlephoto[.]vip/news[.]html) by the operators.
In both situations, a hidden iframe is employed to load and execute
malicious code.

“The URLs used led to a malicious website created by the
attacker, which in turn contained three iframes that pointed to
different sites,” Trend Micro researchers said. “The only visible
iframe leads to a legitimate news site, which makes people believe
they are visiting the said site. One invisible iframe was used for
website analytics; the other led to a site hosting the main script
of the iOS exploits.”

The malware in question exploits a “silently patched” Safari
vulnerability, which when rendered on the browser leads to the
exploitation of a use after free memory
flaw (tracked as CVE-2019-8605)
that allows an attacker to execute arbitrary code with root
privileges — in this case, install the proprietary LightSpy
backdoor. The bug has since been resolved with the release of iOS
12.3, macOS Mojave 10.14.5, tvOS 12.3, and watchOS 5.2.1.

The spyware is not just capable of remotely executing shell
commands and taking full control of the device. It also contains a
variety of downloadable modules that allow for data exfiltration,
such as contact lists, GPS location, Wi-Fi connection history,
hardware data, iOS keychains, phone call records, mobile Safari and
Chrome browser history, and SMS messages.

In addition, LightSpy targets messaging applications like Telegram,
QQ, and WeChat to steal account information, contacts, groups,
messages, and attached files.

A Surveillance Operation Targeting Southeast Asia

It is suspected the TwoSail Junk gang is connected to, or possibly
the same, as the operators of “dmsSpy,” an
Android variant of the same malware that was distributed last year
through open Telegram channels under the guise of Hong Kong protest
calendar apps among others.

“dmsSpy’s download and command-and-control servers used the same
domain name (hkrevolution[.]club) as one of the watering holes used
by the iOS component of Poisoned News,” the researchers
observed.

Once installed, these rogue Android apps harvested and
exfiltrated contacts, text messages, the user’s location, and the
names of stored files.

“This particular framework and infrastructure is an interesting
example of an agile approach to developing and deploying
surveillance framework in Southeast Asia,” Kaspersky researchers
concluded.

Trend Micro, for its part, suggested the design and
functionality of the campaign aim to compromise as many mobile
devices as possible to enable device backdooring and
surveillance.

To mitigate such threats, it’s essential that users keep their
devices up-to-date and avoid sideloading apps on Android from
unauthorized sources.

^[3][4][5][6]