Kaspersky said previously that the attack worked by sending an iMessage with a malicious attachment. Without ever seeing that message, the phone’s user would be infected and the attacker could run code of their choosing. The infection would disappear when users turned their phones off and on again, which experts say consumers should do at regular intervals. Apple’s optional Lockdown Mode also blocked the attacks.
On Wednesday, Kaspersky gave more detail, saying that the malicious code installed after infection had 24 commands, including extracting passwords from Apple’s Keychain, monitoring locations, and modifying or exporting files.
“As we delved into the attack, we discovered a sophisticated iOS implant that displayed numerous intriguing oddities,” said Kaspersky’s Georgy Kucherin, one of three credited by Apple with discovering the vulnerabilities. Kaspersky dubbed the attack Triangulation, and it and others have released tools to check if devices are infected.
Apple said the fixes would protect iPhones running iOS 15.7 or earlier, which became out of date in September. More recent versions of the operating system had other improvements that made them impervious to the attacks. Apple said 90 percent of customers who bought devices in the past four years have updated to iOS 16, the latest major release.
Kaspersky thanked Apple for working with it to analyze and repair the flaws.
Kaspersky in the past has exposed a number of the most sophisticated spying tools the NSA is known to have worked on, including some related to Stuxnet, which disabled Iranian uranium enrichment tools.
U.S. officials later said that Kaspersky’s consumer anti-virus program had been used to extract classified material from an intelligence employee’s home computer. Kaspersky was banned from federal machines, and its share of the U.S. market plummeted.
The infection technique used in Triangulation is similar to that used by NSO and other vendors of high-end spyware. The White House and other U.S. officials have blacklisted NSO for dealing with repressive governments that then spied on innocent citizens.
