Sophisticated Mac attack targeted pro-democracy activists in Hong Kong

the latest tech news, global tech news daily, tech news today, startups, usa tech, asia tech, china tech, eu tech, global tech, in-depth electronics reviews, 24h tech news, 24h tech news, top mobile apps, tech news daily, gaming hardware, big tech news, useful technology tips, expert interviews, reporting on the business of technology, venture capital funding, programing language

November 2021, security researchers at ESET, macOS Catalina, September 23, 2021

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content.

the latest tech news, global tech news daily, tech news today, startups, usa tech, asia tech, china tech, eu tech, global tech, in-depth electronics reviews, 24h tech news, 24h tech news, top mobile apps, tech news daily, gaming hardware, big tech news, useful technology tips, expert interviews, reporting on the business of technology, venture capital funding, programing language

Security researchers have analyzed a now-patched malware attack that was used to compromise Mac devices belonging to Hong Kong pro-democracy activists in November.

The attacks took place in 2021 and relied on a “watering-hole” technique, which involves compromising websites that potential targets might be interested in. Google identified the threat in November 2021, after Apple had patched it in September of that year.

Global Tech News Daily

According to security researchers at ESET, the attack used several chains of iOS and macOS exploits to pull off the campaign, which granted root access to the attackers and allowed them to collect information on a victim’s device.

The attack was deployed on pro-democracy websites, including a fake site possibly created by the attackers and a compromised website belonging legitimate Hong Kong radio station.

Global Tech News Daily

Analysis of the attack indicates that the websites would run checks to see if a Mac was running a vulnerable version of macOS Catalina. If it was, it would run a JavaScript snippet that launched exploit code.

From there, the attack involves a complex WebKit exploit to gain code execution privileges in the browser. ESET notes that the exploit had more than 1,000 lines of code. Some of the code, which was commented out, suggests that the attack could have been deployable on both iOS and on newer iPhone models with Pointer Authentication Code security protections.

Once code execution was granted, the next stage of the attack leveraged an executable file object that exploited another vulnerability to get privilege escalation. This vulnerability granted the attackers root access to a device.

When the attackers gained root access, the next stage involved deploying DazzeSpy, a full-featured backdoor that allowed them to steal files from a computer, perform screen captures, execute commands in the terminal, and log keystrokes. It also gained persistence by adding a plist file to the LaunchAgents folder.

The DazzleSpy malware was also hardcoded to communicate to a single command and control server.

Given the complexity of the attack and the exploits used, ESET theorizes that the group behind it likely has “strong technical capabilities.” Some of the internal error messaging and other artifacts were in Chinese, suggesting an origin in that country.

As mentioned earlier, Apple patched the flaw used in the attack on September 23, 2021.

News Related

OTHER NEWS

Apple TV+ announces 'Slow Horses' spy drama to stream in April

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple, Broadcom win new damages trial in $1.1B Caltech patent case

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Creative TiKTok user converts an iBook G3 into iPad case

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. By ... Read more »

Michigan toddler dials 911 on Apple Watch

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Best deals Feb. 4: $70 off Powerbeats Pro, $220 27-inch 2K monitor, $40 400GB microSD card, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Friday’s ... Read more »

iMac Pro, AirPods Pro 2, and hands-on with Universal Control on the AppleInsider podcast

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. On ... Read more »

MacBook Pro, Pro Display XDR will automatically dim when hot

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Second class action suit targets Powerbeats Pro battery life, charging issues

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Amazon Prime raising annual subscription to $139

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Apple cuts commission by 3% for Dutch apps using third-party payments

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Following ... Read more »

Victrola Revolution Go review: a portable record player perfect for budding music enthusiasts

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Take ... Read more »

UK woman orders iPhone 13 Pro Max, gets a $1 bottle of hand soap instead

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Microsoft tracking increasingly sophisticated Mac trojan that delivers adware

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Microsoft’s ... Read more »

Apple releases trailer for 'Lincoln's Dilemma,' coming to Apple TV+ on Feb. 18

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Glenn Close joins the cast for season 2 of 'Tehran' on Apple TV+, premiering May 6

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Lowest price ever: Apple 24-inch iMac dips to $1,149 for a limited time only

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

AirTags with disabled anti-stalking speakers briefly surface on eBay, Etsy

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Apple's December quarter was its best yet for iPhone sales in India

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple’s ... Read more »

iPad delivery estimates remained extended as Apple prioritizes iPhone 13

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. New ... Read more »

Senate Judiciary advances bill that would force Apple to allow iOS side-loading

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Putting Face ID unlock with masks to the test in iOS 15.4 & how to set it up

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. In ... Read more »

Best deals Feb. 3: AirPods Pro w/ MagSafe $180, $550 off 55-inch LG OLED, 30% off an Eero router, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Thursday’s ... Read more »

Apple TV+ picks up four Bafta film nominations

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Judge dismisses proposed iPhone water resistance class action suit

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Second Israeli firm developed & sold exploit to break into iPhones remotely

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Apple opens 'reimagined' new Abu Dhabi retail store

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

South Korea says Apple's alternative payment plan 'lacks detail'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. South ... Read more »

Battle of the super yachts: Jeff Bezos' Y721 versus Steve Jobs' 'Venus'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. The ... Read more »

Apple urges lawmakers to reject bill that would force it to allow side-loading

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Facebook rebuilding ad platform due to App Tracking Transparency, data laws

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Meta ... Read more »

Apple's board recommends voting against all shareholder proposals

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Unsurprisingly, ... Read more »

How AppleInsider staff continue to work from home, two years later

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. All ... Read more »

Apple Watch Series 7 has a fast charging problem

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. One ... Read more »

Apple TV+ has a TikTok and its first challenge promotes 'The Afterparty'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Apple ... Read more »

Compared: Jabra Elite 4 Active vs AirPods vs AirPods Pro

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Jabra’s ... Read more »

Connecticut man caught placing an AirTag for stalking

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. A ... Read more »

Amazon launches Apple Watch sale, offering lowest prices in 30 days

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. Just ... Read more »

Best deals Feb. 2: $100 off every AirPods Max color, $400 off Vizio 65-inch 4K 120Hz AirPlay TV, more!

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. In ... Read more »

Qualcomm gets another chance to validate patents in Apple lawsuit

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. iPhone ... Read more »

Apple TV+ announces 'Dear Edward' drama from creator of 'Friday Night Lights'

AppleInsider is supported by its audience and may earn commission as an Amazon Associate and affiliate partner on qualifying purchases. These affiliate partnerships do not influence our editorial content. “Friday ... Read more »