TL;DR: Google Threat Analysis Group (TAG) “was able to collect five separate, complete and unique iPhone exploit chains, covering almost every version from iOS 10 through to the latest version of iOS 12,” indicating “a group making a sustained effort to hack the users of iPhones in certain communities over a period of at least two years.”

iPhone iOS 10-12 Exploit: Years of Hacks From 5 Chains, According to Google Threat Analysis

It is being called the largest iPhone hack on record by Google Threat Analysis. Malware by way of unsuspecting websites was said to have hacked iOS for years, and researchers are puzzled as to who exactly orchestrated it or the numbers of users impacted. Encrypted messages were exposed, as were contacts and passwords, … all ripe for the stealing. The only remedy appears to have been updating the phone back in February of this year.

Apple OS expert Jonathan Levin told MIT Technology Review, “The data taken is the ‘juicy’ data. Take all the passwords from the keychain, location data, chats/contacts/etc, and build a shadow network of connections of all your victims. Surely by six degrees of separation you’ll find interesting targets there.” This would, of course, greatly concern cryptocurrency enthusiasts who often use their phone for basic wallet payment and storage services.

Data retrieved from malware was delivered to hackers’ servers, suggesting the years-long operation had some hefting backing, possibly a government. It’s difficult to know the exact scope because malware of its kind lacks any visual display, resting in the background (TAG discovered so-called watering-hole attacks, whereby hackers put up websites awaiting visits — no downloading needed, just surfing over was enough to capture the OS). Unsuspecting thousands, evidently, visited infected websites per week.

Million Dollar Dissident

More than a dozen vulnerabilities were found among 5 exploit chains, including an active zero-day bug — by definition out of Apple’s security reach. By early February of this year, TAG alerted the company, and patch 12.1.4 was implemented. TAG’s Project Zero has taken the opportunity to since study these types of bugs. Project Zero’s Ian Beer explained, “There was no target discrimination; simply visiting the hacked site was enough for the exploit server to attack your device, and if it was successful, install a monitoring implant. We estimate that these sites receive thousands of visitors per week.”

Again, it’s unclear what group or persons was behind the exploit, but some clues are surfacing. Ahmed Mansoor, “a world-renowned human rights activist imprisoned for criticizing the United Arab Emirates government, is nicknamed ‘the million dollar dissident’ because of the high cost of the malware used to hack his iPhone and spy on him,” MIT Technology Review reiterated from the TAG study.

“This is the first time evidence has been found of such exploits being used massively, indiscriminately as ‘net fishing’ against whatever unsuspecting individuals end up visiting the infected websites,” Levin continued. “iOS exploitation requires sidestepping and bypassing Apple’s formidable defenses, in multiple layers.” It could also mean activists and journalists often targeted by governments might feel less inclined to overly-trust iPhone security measures in the future.

DISCLOSURE: The author holds cryptocurrency as part of his financial portfolio, including BCH.

CONTINUE THE SPICE and check out our piping hot VIDEOS. Our podcast, The CoinSpice Podcast, has amazing guests. Follow CoinSpice on Twitter. Join our Telegram feed to make sure you never miss a post. Drop some BCH at the merch shop — we’ve got some spicy shirts for men and women. Don’t forget to help spread the word about CoinSpice on social media.

DYOR: CoinSpice is your home for just spicy crypto things. We’re not affiliated with any cryptocurrency project or token. Each published piece is intended for information purposes only, not investment advice and not in the hope of impacting speculative markets. There are plenty of trading sites and coin-specific advocacy journals out there, we’re neither. CoinSpice strives for rigorous accuracy in our reporting. Information presented here is contingent usually on a host of factors, and the ecosystem moves fast — prices change, projects change, and at warp speed. Do your own research.