China spied on Uyghur population with the recently discovered iPhone exploits

[Freeman]

The recentl iPhone exploit discovered by Project Zero has apparently been utilized for more than two years by the chinese government to spy on its Uyghur population living in the Xinjiang province.

 

Quote

A number of malicious websites used to hack into iPhones over a two-year period were targeting Uyghur Muslims, TechCrunch has learned.

Sources familiar with the matter said the websites were part of a state-backed attack — likely China — designed to target the Uyghur community in the country’s Xinjiang state.

It’s part of the latest effort by the Chinese government to crack down on the minority Muslim community in recent history. In the past year, Beijing has detained more than a million Uyghurs in internment camps, according to a United Nations human rights committee.

Google security researchers found and recently disclosed the malicious websites this week, but until now it wasn’t known who they were targeting.

Original exploit disclosure

China backed group behind many of the incidents

[HeathCliff]

Not even surprised at this point. 

[lewdicrous]

With the things that they've already done to those people, I'd be surprised if they haven't done more than what we already know.

[Freeman]

1 minute ago, lewdicrous said:

With the things that they've already done to those people, I'd be surprised if they haven't done more than what we already know.

 

3 minutes ago, HeathCliff said:

Not even surprised at this point. 

 

True, but I think it's still important to report on it, both to make sure we don't forget about their plight, but also to make sure we don't go down the same way. It's crazy that I still do know people that think China is a great country we should learn from.

[Tech_Dreamer]

i guess it's probably related to national security for this much specific targeting & monitoring.

[Tristerin]

Me: How do they have signal to begin with? 

[Gullerback]

Spying on them when they aren't interned in Concentration camps. why am I not surprised.

[FezBoy]

China will be China.

[Murasaki]

As Linus once said: WAY TO GO CHINA!

[RorzNZ]

This is probably more political than tech really. The way the website says, the malicious code is inserted when user goes to a specific website. Much like any other computer virus. It also targets all devices. Not really apple news or tech news. The source for the news is full of ads and baloney. 

[Commodus]

To expand on what floofer said: the exploits also targeted Android and Windows devices.  iOS just got the initial attention because Google's Project Zero disclosure focused on that platform.

 

If anything, I'd argue that Android users are under greater threat since Google's OS update policies mean there are likely Uyghurs whose phones are permanently vulnerable to the exploits if they're just a year or two old.

[Levent]

Also they werent just doing this in China. "Turkey, Kazakhstan, India, Thailand and Malaysia"

https://www.reuters.com/article/us-china-cyber-uighurs/china-hacked-asian-telcos-to-spy-on-uighur-travelers-sources-idUSKCN1VQ1A5

[DaRk0]

Not surprised. Uyghurs have been used as a destabilizing factor in China through terrorists activities they've been conducting. Not so much in recent years though.

[Video Beagle]

14 hours ago, Commodus said:

To expand on what floofer said: the exploits also targeted Android and Windows devices.  iOS just got the initial attention because Google's Project Zero disclosure focused on that platform.

 

If anything, I'd argue that Android users are under greater threat since Google's OS update policies mean there are likely Uyghurs whose phones are permanently vulnerable to the exploits if they're just a year or two old.

This was covered in last monday's Tech Linked (buried because it wasn't about APPLE anymore but about android and windows too)....

the websites were used for iOS devices because the android devices of travelers there just had spy apps stuck on them by the government.

[LAwLz]

"BUt yOU goT NoTHiNg to feAR iF yOu GoT NOThinG tO HIde"

 

I don't see why people wouldn't be okay with this if they are okay with private companies (or countries that aren't china) monitoring and spying on them.

[Anthoni]

Sounds like China.

[Freeman]

14 hours ago, floofer said:

This is probably more political than tech really. The way the website says, the malicious code is inserted when user goes to a specific website. Much like any other computer virus. It also targets all devices. Not really apple news or tech news. The source for the news is full of ads and baloney. 

 

TechCrunch is well known and reputable news source. And the news absolutely is tech, it deals with use of recently discovered exploit and it's use to extrapolate personal and logistical data from mobile phones.

 

14 hours ago, Commodus said:

To expand on what floofer said: the exploits also targeted Android and Windows devices.  iOS just got the initial attention because Google's Project Zero disclosure focused on that platform.

 

If anything, I'd argue that Android users are under greater threat since Google's OS update policies mean there are likely Uyghurs whose phones are permanently vulnerable to the exploits if they're just a year or two old.

 

The malicious code on the infected websites, which might have been added without the site owner knowledge or consent, was indeed targeting any device, but the attack vectors were critically different. The point of breach used for iOS devices used watering hole 0 day attack that required no further interaction from the user apart from visiting the website. Such an attack is extremely dangerous, as it is hard to do due diligence if you can't even apprise the website safely.
The Android and Windows attack vectors focus on known penetration practices and require the user to take further actions upon visiting the website in order to gain unauthorized access.

 

I'd also like to point out how well the community handled this incident. Project Zero worked with FBI on blocking access and with Apple to quickly implement the fix, the whole situation was professionally handled and only then published. These vulnerabilities are unfortunate, but the impact could be mitigated with professional approach and proper communication, both within the industry and by communication with the wider userbase (something I'm trying to help with, at least a little ).

[Commodus]

3 hours ago, Freeman said:

The malicious code on the infected websites, which might have been added without the site owner knowledge or consent, was indeed targeting any device, but the attack vectors were critically different. The point of breach used for iOS devices used watering hole 0 day attack that required no further interaction from the user apart from visiting the website. Such an attack is extremely dangerous, as it is hard to do due diligence if you can't even apprise the website safely.
The Android and Windows attack vectors focus on known penetration practices and require the user to take further actions upon visiting the website in order to gain unauthorized access.

 

 

 

I'd also like to point out how well the community handled this incident. Project Zero worked with FBI on blocking access and with Apple to quickly implement the fix, the whole situation was professionally handled and only then published. These vulnerabilities are unfortunate, but the impact could be mitigated with professional approach and proper communication, both within the industry and by communication with the wider userbase (something I'm trying to help with, at least a little ).

That's a fair point -- I just wish people would remember that this isn't some declaration on the overall security of iOS.  And what I said about Android remains true to some degree.  Part of why malware outbreaks are much more common on Android is that attackers know that many (if not most) active devices aren't receiving updates and are vulnerable to exploits that Google technically patched a while back.

 

I'm glad everyone cooperated so quickly on the fix.  My main concern is that Google overrepresented the scope of the watering hole and its effect on iOS users at large.  It's good to be concerned about a zero-day like this; it's not to make it sound like this was a full-scale assault on the platform.

[BuckGup]

19 hours ago, Commodus said:

To expand on what floofer said: the exploits also targeted Android and Windows devices.  iOS just got the initial attention because Google's Project Zero disclosure focused on that platform.

 

If anything, I'd argue that Android users are under greater threat since Google's OS update policies mean there are likely Uyghurs whose phones are permanently vulnerable to the exploits if they're just a year or two old.

Yeah but clickbaiting and focusing on Apple gets more traffic which means more money. Very sad news has come to a game of just making money

[pierom_qwerty]

Im more surprised nobody has said this on the forum yet....this info has been out for weeks

[pierom_qwerty]

19 hours ago, floofer said:

This is probably more political than tech really. The way the website says, the malicious code is inserted when user goes to a specific website. Much like any other computer virus. It also targets all devices. Not really apple news or tech news. The source for the news is full of ads and baloney. 

The malicious code only functioned on apple devices. On top of that, hundreds of thousands of devices were affected, and apple tried to cover it up and point fingers.

[Commodus]

51 minutes ago, pierom_qwerty said:

The malicious code only functioned on apple devices. On top of that, hundreds of thousands of devices were affected, and apple tried to cover it up and point fingers.

We've had multiple posts pointing out that these claims are exaggerations.  The sites also targeted Android and Windows users, albeit using different methods; the scale isn't as large as some portrayed; and Apple didn't try to cover up squat.  It had a fix within 10 days of learning of the flaw, and probably wasn't keen on tipping off the Chinese government before enough people had patched up.