Apple provided more details about a hacking campaign targeting iPhones.
Angela Lang/The Techy Trends
Apple vulnerabilities are rare and often worth millions, so it was a revelation when Google disclosed a string of security flaws that allowed for the hacking of any iPhones used to visit certain websites laced with malware. Now Apple is responding to those attacks, offering more details on the scope of the security issues, in a post on Friday.
On Aug. 30, Google’s Project Zero security researchers revealed that they’d found multiple websites with malware that could hack people’s iPhones. The malware had the ability to gain full control, stealing photos, messages and location data, and was installed when an iPhone user visited a certain page. The malware was also able to install more malicious apps, as well as harvest passwords and encrypted messages, according to the security researchers.
Google didn’t disclose what websites the malware was hidden on, but Apple provided more details on Friday.
“First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones ‘en masse’ as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community,” Apple said in a statement.
The Chinese government has made forceful efforts against its Uighur Muslim population, detaining more than 1 million people in its Xinjiang region. Technology has played a key role in these human rights abuses, including the use of facial recognition to track the population. The Chinese government had also reportedly been forcing visitors at Xinjiang’s borders to download malware on devices to scan for files related to Islamic content. On Thursday, Reuters reported that a hacking campaign compromising several telecom companies was also targeting Uighur Muslims.
Security company Volexity detailed a hacking campaign targeting Uighur Muslims in China on Monday, finding at least 11 websites compromised to infect Android devices and collect similar data. Those websites included pages related to Uighur news and press in Turkey.
Google didn’t respond to a request for comment.
Volexity noted that the attacks had “possible ties” to the security flaws disclosed by Google last week. After the disclosure, sources told TechCrunch that China was potentially behind the attacks targeting Uighur Muslims.
Apple didn’t specifically point to China as being behind these attacks but noted that it was targeting the Uighur population. It also denied that the attacks had been going on for two years and said that the website attacks were active for only two months.
“We fixed the vulnerabilities in question in February — working extremely quickly to resolve the issue just 10 days after we learned about it. When Google approached us, we were already in the process of fixing the exploited bugs,” Apple said in its statement.
