"Operation Triangulation" securelist.com/operation-tri… A newly discovered spyware campaign targeting Apple iPhone using a zero-click remote code execution via an attack chain of 4 zero-days, including highly mysterious, completely undocumented MMIO registers and hardware features that are not even ever used by the firmware. TLDR the attack begins with an iMessage to an arbitrary phone that, without any user action and invisibly, gets it to collect and upload tons of private data (and much more, e.g. microphone recordings) from there on, and actively takes steps to hide all of this activity from the user and aspiring forensic researchers. Apple has patched the core vulnerability on Oct 25, 2023. "This is definitely the most sophisticated attack chain we have ever seen" The talk itself, a lot more wild information there: youtube.com/watch?v=7VWNUUld… The author of this attack is unknown, as is the method by which they gained knowledge of these unused, undocumented hardware features. Russia's intelligence service accused Apple of providing the NSA with a backdoor. For a more general audience intro to this underworld I usually recommend the book "Countdown to Zero Day".

The Reproducible Analytical Pipelines (RAP) strategy launches today! Take a look at the strategy on the @gov_analysis website and head over to the blog for more information. Strategy: bit.ly/RAPStrategyAF Blog: bit.ly/RAPBlogAF