Apple patches zero day linked to spyware campaign

Apple has released a patch for a number of vulnerabilities including an actively-exploited zero-day vulnerability linked to an ongoing spyware campaign.

The zero-day flaw, tracked as CVE-2023-38606, made it possible for an app to alter the state of a device’s kernel which could allow an attacker to leverage root-level control over a compromised device.

It was reported by researchers at Kaspersky Lab as part of an ongoing effort to uncover a sophisticated attack chain used as a vector in a spyware operation dubbed ‘Operation Triangulation’.

Researchers first reported the spyware in June, after uncovering evidence to suggest that an advanced persistent threat (APT) campaign had been working against Kaspersky staff since 2019.

At the time, it was noted that the spyware arrives through a malicious iMessage. This subsequently activates a payload using a zero-click method, so goes entirely unnoticed by victims.

Apple’s update also introduced fixes to a WebKit remote code execution flaw (CVE-2023-38594), a libxpc vulnerability that could allow an app to obtain root privileges (CVE-2023-38565), and an Apple Neural Engine flaw linked to arbitrary code execution (CVE-2023-38136).

In all, updates were released for:

• Safari 16.6 (macOS Big Sur and macOS Monterey)
• iOS 16.6, iPadOS 16.6 (iPhone 8 and later, all iPad Pro models, iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later)
• iOS 15.7.8 and iPadOS 15.7.8 (all models of iPhone 6s and iPhone 7, 1st generation iPhone SE, iPad Air 2, 4th generation iPad mini, and 7th generation iPod touch
• macOS Ventura 13.5
• macOS Monterey 12.6.8
• macOS Big Sur 11.7.9
• tvOS 16.6 (All models of Apple TV 4K and Apple TV HD)
• watchOS 9.6 (Apple Watch Series 4 and later)

In the weeks since Operation Triangulation was made public, researchers have performed more detailed analyses on the vector and exfiltration implant used by the spyware’s operators. 

The threat actors exploit the zero day (CVE-2023-38606) to gain root privileges on a victim’s iOS device, and then deploy the implant, which Kaspersky dubbed ‘TriangleDB’.

This works to alter or delete files, exfiltrate key files such as certificates or keys, and send precise geolocation data back to the operators. 

Removing the spyware via a factory reset of the phone removes all evidence of the attack, and as it operates in a device’s memory it has proved difficult to track. 

By default, TriangleDB deletes itself after 30 days, though attackers can extend or shorten this period through commands send from their command-and-control (C2) infrastructure.

Researchers also found that TriangleDB’s configuration class contains a method titled ‘populateWithFieldsMacOSOnly’, leading them to warn that future such spyware attacks could occur against macOS devices.

“An app may be able to modify sensitive kernel state. Apple is aware of a report that this issue may have been actively exploited against versions of iOS released before iOS 15.7.1,” Apple wrote.

The firm stated that the issue has been resolved using an improved state management method, but did not go into further detail on what this entails.