Skip to content

Defender Daily

Subscribe
Menu
Brief for Thu, Nov 5

In the brief for Thu, Nov 5

Apple flaw used in watering-hole attacks to steal iPhone cookies, Sekoia says

Affected
Releases before iOS and iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5, Apple says. All versions and fixes

Attackers used , a WebKit flaw in Apple’s operating systems, to steal cookies from devices running iOS 16.7, Sekoia says. The exploits were served from compromised and cloned websites in the US, Ukraine, the Czech Republic and Bulgaria. Sekoia links the campaign to APT29 with moderate to high confidence. Apple fixed the flaw in May 2024, and CISA added it to KEV on Nov 4.

Each infected page loads a script that reports the visitor’s operating system and browser, and the attackers’ server answers with a matching exploit chain that needs no clicks, Sekoia says. On iOS 16.7, WebKit flaw runs code in the browser, and gets that code past Pointer Authentication, which Apple chips use to block tampered code pointers. The payload then uploads the device’s cookies. A second iOS chain, from an exploit kit called DarkSword, takes messages, Keychain passwords, location data and photos from devices on iOS 18.5. An Android chain takes Chrome cookies and saved Wi-Fi passwords.

Sekoia found the script on the websites of a Ukrainian gas production company, a US chemical industry trade association and a far-right European political party, among others. Two lookalike domains passed visitors through to the real websites of America250 and the Raffles London hotel at The OWO, adding the script on the way. From Aug 27 to Sep 3, the attackers also altered the tracker of Ukrainian analytics service Plerdy, which thousands of mostly Ukrainian websites load. Sekoia says some of them are army, special forces and military equipment websites.

Sekoia says APT29 is widely attributed to Russia’s Foreign Intelligence Service (SVR). It also says Google’s Threat Analysis Group confirmed that the framework resembles one APT29 used in 2024 against Mongolian government websites, which also stole cookies. Sekoia says stolen cookies may let the group reuse signed-in sessions, including webmail, and that the payloads set up no persistence on the device.

Every flaw in the three chains was fixed before the campaign began, and Sekoia says a device running an up-to-date operating system is safe from these attacks. The other flaws in the chains were already in KEV. Sekoia is working with the CERTs of the affected countries to identify victims and weigh ways to disrupt the infrastructure. It hasn’t named the compromised websites, and it keeps further delivery and exfiltration hosts for customers of its threat intelligence service and for CERTs and police.

CVE
Vendors
Apple, Google

What to do

6 steps

Affected and fixed versions

  • Product
    iOS and iPadOS 17
    Affected
    Before 17.5
    Fixed
    17.5 or later
  • Product
    iOS and iPadOS 16
    Affected
    Before 16.7.8
    Fixed
    16.7.8 or later
  • Product
    macOS Sonoma
    Affected
    Before 14.5
    Fixed
    14.5 or later
  • Product
    Safari on macOS Monterey and Ventura
    Affected
    Before 17.5
    Fixed
    17.5 or later
  • Product
    tvOS
    Affected
    Before 17.5
    Fixed
    17.5 or later
  • Product
    watchOS
    Affected
    Before 10.5
    Fixed
    10.5 or later

Indicators

Domains, URLs and IPs copy defanged. Use Copy raw for queries.

DomainExploit delivery host, per Sekoia
DomainDelivery host that redirects to other delivery hosts, per Sekoia
DomainDelivery host reached by redirect, per Sekoia
DomainDelivery host reached by redirect, per Sekoia
DomainDelivery host reached by redirect, per Sekoia
DomainDelivery host reached by redirect, per Sekoia
DomainDelivery host for one lookalike website, per Sekoia
DomainExfiltration host, per Sekoia
URLExfiltration endpoint for stolen iOS data, per Sekoia
DomainLookalike proxy of the America250 website, per Sekoia
DomainLookalike proxy of a London hotel’s website, now offline, per Sekoia
IP addressExploit delivery host, per Sekoia
Network
IP addressDelivery host that redirects, per Sekoia
Network
IP addressExfiltration host, per Sekoia
Network
IP addressLookalike proxy website, per Sekoia
Network
IP addressLookalike proxy website, per Sekoia
Network
File nameFingerprinting script name common to every victim Sekoia observed
SHA-256iOS 16.7 chain, stage 1, per Sekoia
SHA-256iOS 16.7 chain, stage 2, per Sekoia
SHA-256iOS 18.5 chain, stage 1, per Sekoia
SHA-256iOS 18.5 chain, stage 2, per Sekoia
SHA-256iOS 18.5 chain, stage 3, per Sekoia
SHA-256Android chain, stage 1 JavaScript, per Sekoia
SHA-256Android chain, stage 2 JavaScript, per Sekoia
SHA-256Android chain payload for Chrome 139 to 144, per Sekoia
SHA-256Android chain payload for Chrome 145, per Sekoia
SHA-256Android chain, Adreno driver exploit shellcode, per Sekoia
SHA-256AndroSnitch, the Android data stealer, per Sekoia

Timeline

  1. May 13, 2024Apple fixes the flaw in iOS and iPadOS 17.5 and 16.7.8, macOS Sonoma 14.5, Safari 17.5, tvOS 17.5 and watchOS 10.5.
  2. Aug 27The attackers alter Plerdy’s analytics tracker, which stays compromised until Sep 3, Sekoia says.
  3. Nov 4Sekoia reports the campaign and links it to APT29 with moderate to high confidence.
  4. Nov 4CISA adds the flaw to KEV.

Sources

Tags

AppleGoogleChromeiOS and iPadOSAPT29AndroSnitchDarkSwordSupply chain

Subscribe

Get the Daily Brief by email

Weekdays at 7am ET.

We’ll email you a link to confirm. Unsubscribe from any email.

RSS feed