Hackers exploited iOS and Android flaws to infect phones
Hackers exploited iOS and Android flaws to infect phones
Hackers possibly linked to the Kremlin exploited previously patched iOS and Android flaws in an attempt to hack visitors of multiple websites, including one celebrating the 250th anniversary of American independence, researchers said Wednesday. The attackers, which the researchers assessed with “moderate to high confidence” were part of Russia’s Foreign Intelligence Service, targeted other sites, many with links to that country’s ongoing war against Ukraine.
研究人员周三表示，可能与克里姆林宫有关的黑客利用了此前已修复的 iOS 和 Android 漏洞，试图攻击多个网站的访问者，其中包括一个庆祝美国独立 250 周年的网站。研究人员以“中等到高度的信心”评估认为，这些攻击者隶属于俄罗斯对外情报局，他们还针对了其他许多与该国对乌克兰持续战争有关的网站。
The attacks began when iPhone or Android users visited one of potentially hundreds of different sites. JavaScript injected into the traffic then profiled the device. The final payloads, tailored to the type of platform visiting, attempted to steal browser cookies and, in some cases, Wi-Fi passwords and full mobile device data.
当 iPhone 或 Android 用户访问可能多达数百个不同网站中的任意一个时，攻击便开始了。注入到流量中的 JavaScript 随后会对设备进行画像。针对访问平台类型量身定制的最终有效载荷，会试图窃取浏览器 Cookie，在某些情况下还会窃取 Wi-Fi 密码和完整的移动设备数据。
One of the impersonated sites was america250.org, belonging to a non-partisan group of lawmakers, business executives, and at least one former member of the Trump administration. The attackers registered america250[.]holiday and used it as a reverse proxy to america250.org. The imposter website delivered content from the real one that added malicious JavaScript into it.
被冒充的网站之一是 america250.org，该网站属于一个由立法者、企业高管和至少一名特朗普政府前成员组成的无党派团体。攻击者注册了 america250[.]holiday，并将其用作 america250.org 的反向代理。这个冒牌网站在提供真实网站内容的同时，在其中添加了恶意 JavaScript 代码。
“We assess that the intrusion set may have deliberately selected this website due to its association with a high-profile national celebration, potentially leveraging the event as a pretext for invitation-themed spear-phishing campaigns,” researchers from security firm Sekoia said. A second website, theowo[.]club, proxied the website Raffles of London OWO, a luxury hotel physically close to some of the UK’s most sensitive government institutions, including the Ministry of Defence and 10 Downing Street, the official residence and office of the British Prime Minister.
安全公司 Sekoia 的研究人员表示：“我们评估认为，该入侵组织可能是有意选择了这个网站，因为它与一场备受瞩目的全国性庆祝活动有关，并可能利用该活动作为以邀请为主题的鱼叉式网络钓鱼活动的借口。”第二个网站 theowo[.]club 则代理了伦敦莱佛士酒店（Raffles of London OWO），这是一家地理位置靠近英国一些最敏感政府机构的豪华酒店，其中包括国防部和英国首相官邸及办公室唐宁街 10 号。
Open source reporting indicates that Ukrainian President Volodymyr Zelenskyy stayed there during a visit on October 14. “By doing this watering hole [impersonating] the Raffles London at The OWO, the intrusion set may have sought to target diplomatic delegations and high-profile guests through targeted spear-phishing campaigns,” the researchers said.
开源报道显示，乌克兰总统弗拉基米尔·泽连斯基在 10 月 14 日访问期间曾下榻于此。研究人员称：“通过这种针对伦敦莱佛士酒店的‘水坑攻击’（冒充），该入侵组织可能试图通过有针对性的鱼叉式网络钓鱼活动，瞄准外交代表团和高层贵宾。”
The attackers also delivered their attacks through compromised websites—including a top Ukrainian gas production company—and a Ukrainian web analytics service that serves thousands of websites. Sekoia said its attribution to the Kremlin is based on the targets’ profiles and similarities to a previous attack attributed to APT29, one of the names the suspected Russian group is tracked under.
攻击者还通过受感染的网站（包括一家乌克兰顶级天然气生产公司）以及一家服务于数千个网站的乌克兰网络分析服务进行攻击。Sekoia 表示，其将攻击归因于克里姆林宫是基于目标的特征，以及与此前归因于 APT29（该疑似俄罗斯组织所使用的名称之一）的攻击存在相似之处。
The hackers relied on three infection vectors: direct JavaScript injection into traffic from legitimate websites, proxy domains such as america250[.]holiday, and the supply-chain compromise of the Ukrainian web analytics service. In each case, the injected JavaScript was the same. During the first stage, the JavaScript profiled the visitor’s browser and device.
黑客依赖三种感染途径：直接向合法网站的流量中注入 JavaScript、使用诸如 america250[.]holiday 之类的代理域名，以及对乌克兰网络分析服务进行供应链攻击。在每种情况下，注入的 JavaScript 都是相同的。在第一阶段，JavaScript 会对访问者的浏览器和设备进行画像。
The attackers then used that information to deliver one of three zero-click exploit chains, which work without requiring any interaction from the target. One of the chains was DarkSword, an iOS exploit kit that Google researchers said customers of PARS Defense, a commercial surveillance vendor in Turkey, and at least two other threat actors have used.
随后，攻击者利用这些信息发送三种零点击漏洞利用链中的一种，这些漏洞利用链无需目标进行任何交互即可生效。其中一个链条是 DarkSword，这是一种 iOS 漏洞利用工具包，谷歌研究人员称，土耳其商业监控供应商 PARS Defense 的客户以及至少另外两个威胁行为者曾使用过该工具包。
Sekoia said the more recent campaign used two other exploit chains that weren’t named. All of the vulnerabilities exploited in the campaign were “n-days,” meaning they had already been patched and attacks worked only on outdated versions of iOS or Android.
Sekoia 表示，最近的行动使用了另外两个未命名的漏洞利用链。此次行动中利用的所有漏洞均为“n-day”漏洞，这意味着它们此前已得到修复，攻击仅对过时的 iOS 或 Android 版本有效。