Kaspersky researchers are detailing “an attack that over four years backdoored dozens if not thousands of iPhones, many of which belonged to employees of Moscow-based security firm Kaspersky.” It’s a zero-click exploit that makes use of four iPhone zero-days.

The most intriguing new detail is the targeting of the heretofore-unknown hardware feature, which proved to be pivotal to the Operation Triangulation campaign. A zero-day in the feature allowed the attackers to bypass advanced hardware-based memory protections designed to safeguard device system integrity even after an attacker gained the ability to tamper with memory of the underlying kernel. On most other platforms, once attackers successfully exploit a kernel vulnerability they have full control of the compromised system.

On Apple devices equipped with these protections, such attackers are still unable to perform key post-exploitation techniques such as injecting malicious code into other processes, or modifying kernel code or sensitive kernel data. This powerful protection was bypassed by exploiting a vulnerability in the secret function. The protection, which has rarely been defeated in exploits found to date, is also present in Apple’s M1 and M2 CPUs.

The details are staggering:

Here is a quick rundown of this 0-click iMessage attack, which used four zero-days and was designed to work on iOS versions up to iOS 16.2.

• Attackers send a malicious iMessage attachment, which the application processes without showing any signs to the user.
• This attachment exploits the remote code execution vulnerability CVE-2023-41990 in the undocumented, Apple-only ADJUST TrueType font instruction. This instruction had existed since the early nineties before a patch removed it.
• It uses return/jump oriented programming and multiple stages written in the NSExpression/NSPredicate query language, patching the JavaScriptCore library environment to execute a privilege escalation exploit written in JavaScript.
• This JavaScript exploit is obfuscated to make it completely unreadable and to minimize its size. Still, it has around 11,000 lines of code, which are mainly dedicated to JavaScriptCore and kernel memory parsing and manipulation.
• It exploits the JavaScriptCore debugging feature DollarVM ($vm) to gain the ability to manipulate JavaScriptCore’s memory from the script and execute native API functions.
• It was designed to support both old and new iPhones and included a Pointer Authentication Code (PAC) bypass for exploitation of recent models.
• It uses the integer overflow vulnerability CVE-2023-32434 in XNU’s memory mapping syscalls (mach_make_memory_entry and vm_map) to obtain read/write access to the entire physical memory of the device at user level.
• It uses hardware memory-mapped I/O (MMIO) registers to bypass the Page Protection Layer (PPL). This was mitigated as CVE-2023-38606.
• After exploiting all the vulnerabilities, the JavaScript exploit can do whatever it wants to the device including running spyware, but the attackers chose to: (a) launch the IMAgent process and inject a payload that clears the exploitation artefacts from the device; (b) run a Safari process in invisible mode and forward it to a web page with the next stage.
• The web page has a script that verifies the victim and, if the checks pass, receives the next stage: the Safari exploit.
• The Safari exploit uses CVE-2023-32435 to execute a shellcode.
• The shellcode executes another kernel exploit in the form of a Mach object file. It uses the same vulnerabilities: CVE-2023-32434 and CVE-2023-38606. It is also massive in terms of size and functionality, but completely different from the kernel exploit written in JavaScript. Certain parts related to exploitation of the above-mentioned vulnerabilities are all that the two share. Still, most of its code is also dedicated to parsing and manipulation of the kernel memory. It contains various post-exploitation utilities, which are mostly unused.
• The exploit obtains root privileges and proceeds to execute other stages, which load spyware. We covered these stages in our previous posts.

This is nation-state stuff, absolutely crazy in its sophistication. Kaspersky discovered it, so there’s no speculation as to the attacker.

The post Don’t think about it too long or you’ll hate everything. appeared first on Indexed.

Jon Grobman was certain he would never again see the world beyond the walls of Lancaster’s maximum-security prison. In 2005, the former hotel and casino manager was sentenced to 190 years behind bars with no possibility for parole. “Grand theft, burglary, forgery, embezzlement, meth possession,” he ticks off his rap sheet highlights. “All non-violent crimes, but under California’s Three Strikes Law, I got a life sentence for each offense.” 

Now Grobman, 54, lives in Napa Valley with his family. He is the first lifer in California whose harsh sentence was overturned four years ago by a barely known legal clause called “Recall of Commitment.” Grobman, who qualified for the commutation due to his “extraordinary behavior,” believes he owes it all to the first dog who started his journey to rehabilitation: Oreo, a black-and-white lab mix.

In 2014, dog rescue volunteer Alex Tonner set out to temporarily house dogs in prison as a way to save them from overcrowded shelters where they would be killed for lack of space. “I was only interested in saving the dogs,” the blonde Brit admits with refreshing honesty and a self-deprecating laugh. “I really didn’t care about the guys. But that quickly changed.” 

In a way, animal shelters resemble prisons: dogs and cats are often warehoused behind bars,  many of them facing a death sentence for crimes they didn’t commit. “They’re cast away because society doesn’t want them anymore,” Grobman says. “Just like us.”

In 2014, Tonner founded the non-profit Paws for Life K9 Rescue and launched California’s first dog rehabilitation program in the men’s maximum-security prison in Lancaster. Incarcerated people commit to spending at least six weeks with a pup from a high-kill shelter, working with a trainer so the dogs get the Good Canine Certificate and become more adoptable. 

Since its inception, the program has expanded exponentially. It has now saved and placed more than 680 dogs, expanded to three prisons (Lancaster, Mule Creek, and Vacaville), enrolled 185 incarcerated people as trainers, and added a service dog program where the dogs spend up to a year with the prison trainers to eventually help veterans and first responders suffering from PTSD.  Every dog has found a home. But the most surprising result of the program is the effect it has on the humans: 39 Paws for Life participants, most of whom were serving life sentences, have had those sentences commuted — more than any other prison program in California. “Paws up!” all the prison residents yell with their hands raised when the dogs graduate or when someone gets released.

When the program started, Grobman was not even eager to participate, but they couldn’t find enough guys to enroll. “It all changed when they brought in the first dogs,” he remembers. “Oreo bit me several times, but I was already hooked. There was too much joy involved in every aspect of having a dog.” Emotion coats his voice when he speaks of the “healing that took place. To receive unconditional love from an animal is life-changing when 10 or 20 years ago, you were the animal, and you didn’t deserve a second chance.”

In the PBS documentary Shelter Me, musician John Legend says, “This program gives both dogs and humans a second chance at finding purpose and happiness.” You see, for instance, how Alex Tonner brings a shy gray pitbull named Asher into the prison. “He was scared, his tail tucked in; it reminded me so much of myself when I first came in,” says his prison trainer Miguel Rendon. Six weeks later, Asher confidently wags his tail as he performs the sit and down commands Rendon has taught him, but Rendon breaks down crying as he hands over Asher’s leash to his new owner. “It works on a part of your soul that’s been neglected, sometimes for decades and decades,” fellow participant Louie Brash chimes in. “Everybody knows that the dogs are helping us.”

The prison went from struggling to find its first 14 participants to eventually having a waiting list of 200 men. In prison, Grobman says, “You’re just a number. But a dog doesn’t know that. He doesn’t ask what crime you committed.” Especially in his case, “the judge specifically said I had no worth to society. He was very clear that if he thought I would ever have a prospect of being successful, he would not have given me that much time. That was my mindset: I’m worthless.”

Not only did the dogs emerge as better behaved companions, they fundamentally transformed the atmosphere in the prison. “Hurt people hurt people,” Grobman says. “A large percentage of inmates grew up in violent households or were abused. It’s about breaking that cycle. So many didn’t have someone they could trust. The program humanizes you and makes you feel you’re worthy of love.”

The program is no longer just about dog training. “There is so much racism, violence and anger in prison,” Grobman says. “The biggest challenge we had to overcome was to create a culture of family within our program. We did that by putting the dog first.” When he put together a team of three, he would “choose a white guy, a Hispanic and a Black person, on purpose… They work together for the dog, and they learn to respect each other.” A prison warden confirms in the documentary, “The inmates are totally different in here. They are very respectful; it’s a totally different world.” And Alex Tonner now calls them family. “I’m in awe of them,” she says. “I feel people shouldn’t just be locked up, and you throw away the keys. They should have a chance to rehabilitate themselves.” 

In Shelter Me, Grobman visits former governor Jerry Brown who calls the dog program “part of the transformation that is underway in our prisons. It has a very significant impact.” 

Tonner’s and Grobman’s vision is that other prisons and states will use their experience as a template. There are already programs in other states with slightly different models, like TAILS (Teaching Animals and Inmates Life Skills) in Florida, or Puppies Behind Bars, where incarcerated folks train young puppies from the age of eight weeks for two years as service dogs for veterans and first responders, and explosive-detection canines for law enforcement. 

But in 2018, a violent incident at another prison program shocked the rescue community: an incarcerated man in Lebanon, Ohio, beat a young German shepherd to death in his cell. The rescue organization there immediately suspended all prison activities.

Tonner assures me that no animal abuse has taken place in their program. “I’ve pulled a guy out of the program just for holding the leash too tight,” she says. She has safety measures in place: Only people who have had zero disciplinary actions against them for at least two years can apply, and those who have been sentenced for child or animal abuse are excluded. Two to three guys form a team to train each dog. Participating in the program has become a perk none of the prisoners wants to lose.

Jon Grobman is now Paws for Life’s program director on the outside and regularly visits his old pals. He shakes his head as he sits in his tiny former prison cell at Lancaster, number 135, and the heavy blue metal doors clank shut. “For a long time, I cried every time I left prison. Survivor’s guilt. There are so many men in there who deserve an opportunity. But I also understand the hope and inspiration I bring when I go back in.” He is especially proud that not a single Paws for Life participant has reoffended. Many of the participants who were able to have their sentences commuted use their training experience to work as dog trainers or groomers, or run boarding facilities.

Grobman helps his incarcerated friends transition when they are released. “I remember standing at the self-checkout kiosk at Target and being so embarrassed because I couldn’t figure it out. So I give back to other brothers who are getting out, help people navigate the barriers of society.” In fact, Paws for Life just finished building a dog training center in Mission Hills, The People and Pet Innovation Center, that doubles up as a reentry program.

Grobman got a farewell gift from the prison, too. When he was scheduled to appear before a judge after 11 years at Lancaster for his “Recall of Commitment” hearing, he tried not to get his hopes up and expected this would be the first of many court hearings with a minimal chance of success. But the judge (who hadn’t previously heard of this legal clause either) was so impressed with Grobman that he released him on the spot. “Ten hours later I was standing on the street with my father, my lawyer and my girlfriend, crying my eyes out,” he says. The judge didn’t even put him on parole. He was a free man. “I couldn’t believe it.” 

At the time, Grobman had been taking care of a Belgian Malinois who had been shot in the chest on the streets of Stockton. In prison, Grobman nursed him back to health, and when Grobman didn’t return, the dog stopped eating. The prison administration decided they had no choice but to send Mallie out to live with Grobman. “Before that I used to tell Alex, every dog that leaves prison takes a piece of my heart with them, not thinking I would ever be free.”

The post Locked Up and Finding Their Way Together appeared first on Reasons to be Cheerful.