There have been reports that recent exploit attacks on iOS and Android web browsers by Russian hacking group APT29, have been detected by Google:
The Google TAG report, authored by Clement Lecigne, and published on August 29, revealed that the exploits being deployed by the Russian state-sponsored APT29 hacking group were the same as those used by commercial spyware vendors in the past.
Observed by the Google and Mandiant security analysts between November 2023 and July 2024, the exploits formed part of what is known as a watering hole attack. This is pretty much what you would expect it to be: a cyberattack targeting victims by infecting a website or service that they would ordinarily use and trust. Just like predators who attack their prey by hiding near real watering holes for thirsty animals at their most vulnerable. “The use of watering hole attacks circumvents traditional web security controls like URL categorization filters,” Adam Maruyama, field chief technology officer at Garrison Technology said, “because the owner of the site and the human-readable content hosted there are legitimate, leaving only a few layers of protection between the end user’s device and the malicious webcode.” The threat becoming even more acute on mobile devices, Maruyama continued, “where few users have endpoint protection products to stop even known exploits, leaving unpatched devices vulnerable.”
The prey in these particular attacks were Mongolian government websites, although the same tactic would apply to any targeted victim. State-sponsored groups such as APT29 tend to go for big game, as it were, being commercial and government organizations that benefit their paymasters most. The common denominator was that the victims were using the Safari browser on older versions of iOS (those before 16.6.1) initially and then Android users running the m121 to m123 versions of the Chrome browser. It should be noted that fixes had already been made available for the vulnerabilities exploited in these attacks, but users who were using unpatched versions were at risk.
Alan Bavosa, VP of Security Products at Appdome had this comment:
“While the APT29 group attack is focused on mobile browsers, the real targets ultimately are the Android and iOS apps running on unprotected end-user devices. To counter such threats, comprehensive mobile app protection is vital. App developers need to protect their apps and mobile end users from these and other attacks, using basic mobile app security protections as well as protections against new, sophisticated attacks, such as accessibility malware and social engineering attacks.”
“The nature of today’s mobile attack landscape means that it is difficult, if not impossible, for mobile end users to protect themselves.”
“Consumers are holding mobile brands accountable for mobile app defense. In order for mobile developers to keep up, they must implement automated mobile app defense systems to combat today’s increasingly sophisticated cyber threats rather than using SDKs or protecting their apps from scratch.”
This is a wakeup call for consumers and brands on how vulnerable the little rectangles we carry around with us everywhere we go really are. Thus updates need to be issued and applied and app companies need to make sure that their apps are secure.
Telegram CEO To The World: I’ll Moderate Content On My Platform
Posted in Commentary with tags Telegram on September 6, 2024 by itnerdIt’s amazing what an arrest will make you do.
Pavel Durov who is the CEO of Telegram, and who was arrested by French authorities and now is facing charges related to child sexual abuse material, drug trafficking, importing cryptology without prior declaration, as well as a “near-total absence” of cooperation with French authorities, has broken his silence on these events. You can read his full statement here. I encourage you to read his statement, but here’s the things that it covers:
I will also note that it appears that this process of better moderation is beginning. The Verge notes that Telegram has already updated its FAQ to note that private chats are no longer shielded from being moderated.
I guess that he’s hoping that if he does this, French authorities won’t ship him to some dark prison cell for a long time. I am not sure if that will work, but good luck to him I suppose.
Leave a comment »