Mobile Malware · Real-World Cases · Lesson 4 of 5

Operation Triangulation

How a security company found a zero-click iPhone chain on its own staff's phones.

Caught by the network

On June 1, 2023, the security company Kaspersky published a report called Operation Triangulation. Among the targets were iPhones belonging to its own employees. The way they found it is a lesson in detection, because nobody saw anything wrong on the phones themselves.

Kaspersky's team was watching the traffic on its corporate Wi-Fi network for mobile devices with a SIEM (security information and event management system, a tool that collects and searches logs from across a network). It flagged suspicious activity from several iPhones. Kaspersky later described the pattern: connections to Apple's iMessage and attachment download servers, followed by sessions sending unusually large amounts of data out to unknown servers.

Next problem: you can't simply browse an iPhone's internal files, as you saw in iOS Internals and Mobile Forensics. So the team made offline backups of the phones and analyzed them with the Mobile Verification Toolkit (MVT), the free tool Amnesty's Security Lab built for spyware investigations. In the backups they found traces that didn't belong:

• Data usage records for a system process that shouldn't normally use the network.
• Changed but empty attachment folders, as if a message had been cleaned up.
• Tampering with a software update settings file, which is why infected phones couldn't install iOS updates.

The oldest traces went back to 2019. As of June 2023, the newest version Kaspersky had seen successfully attacked was iOS 15.7. The infection started with an iMessage carrying a malicious attachment, which needed no tap and was then deleted. The spyware didn't survive a restart, but Kaspersky warned a phone could simply be attacked again. Kaspersky also released a free checking tool so others could scan their own backups.

Note the bigger point. The phone hid the attack well, but it still had to talk to the internet. Network monitoring found the first clue, and the backups confirmed it.

Four bugs, one mystery, careful words

Over the next months Kaspersky rebuilt the full chain, and presented it at the Chaos Communication Congress in Hamburg on December 27, 2023. In plain terms, the attack used four vulnerabilities that Apple has since fixed:

• A font processing bug (CVE-2023-41990) that let the attachment run code. Apple had fixed it in iOS 16.3 and iOS 15.7.8.
• A kernel bug (CVE-2023-32434) that gave access to the phone's memory.
• A hardware level trick (CVE-2023-38606), described below.
• A Safari bug (CVE-2023-32435), used in a later stage.

Apple released fixes for the kernel and Safari bugs on June 21, 2023 (iOS 16.5.1 and iOS 15.7.7), crediting Kaspersky. Kaspersky separately named the main spyware it found TriangleDB.

The hardware piece is why researchers called it unusual. Apple's chips include Page Protection Layer (PPL), a memory protection built on special chip features that stops even code running in the kernel from changing certain sensitive memory. The attackers used hidden, undocumented hardware registers (control addresses on the chip, linked to the graphics processor) to write to memory and get around that protection. Kaspersky said it didn't know the feature's original purpose or how the attackers learned about it. Apple's fix in iOS 16.6 blocked access to those addresses.

Now attribution. On the same day as Kaspersky's report, Russia's FSB security service publicly claimed the operation was run by US intelligence and alleged Apple's cooperation. Apple denied ever working with any government to put a backdoor into its products. Kaspersky said it could not conclusively attribute the attack to any known threat actor. A careful analyst reports exactly that: who made which claim, and what evidence was published. A government statement is a claim, not technical proof.