跳至主要内容

Hacking Team不需越狱即可监控iOS用户

原文来自乌云,备份地址

0x00 简介


近日总部位于意大利的监控软件开发公司HackingTeam被黑,415GB文件被泄露,HackingTeam泄漏的数据至少涉及多个针对Android 4.4以下版本的远程代码执行和提权漏洞、多个针对Java、Word的浏览器沙箱逃逸漏洞的完整攻击代码(exploit)以及MacOS X、iOS、Android、WP8等系统的恶意软件代码,里面有Flash 0day, Windows字体0day, iOS enterprise backdoor app, Android selinux exploit, WP8 trojan,更为严重的是,Hacking Team 的终极远控系统RCS,能够感染包括云平台在内的几乎所有平台或介质,实现了全平台的RSC系统(包括windows phone)。
在HackingTeam泄漏的文件,我们发现了有针对IOS进行监控的代码,一旦用户点击运行,就会请求获取一些数据的访问权限并追踪用户的位置,日历和联系人。在这个过程中,手机不需要越狱即可实现。

0x01 监控行为分析


相关代码在\core-ios-master.zip\core-ios-master\ios-newsstand-app\newsstand-app文件夹下,通览全部源码之后,我们发现,监控的实现,主要是通过在目标设备上安装一个报刊杂志应用,该应用安装后显示为一个空白应用,也没有图标。起代码文件如下所示:
enter image description here
首先查看一下应用的信息文件info.plist,通过该文件知道该应用为一个报刊杂志类(NewsstandApp)应用,并指定了应用的显示风格和图标,部分信息如下所示:
enter image description here
然后看程序入口模块Main.m,Main函数直接调用了AppDelegate类模块启动应用。
enter image description here
AppDelegate模块主要功能是任务的派发以及后台刷新。包括后台获取访问权限,不断刷新获取用户日历,联系人以及照片任务,键盘任务等。
enter image description here
同时该模块调用接口ViewController创建了一个nil类型的gMainView,当view需要被展示而它却是nil时,viewController会调用该方法
enter image description here
该方法中实现了获取用户信息的主要功能,其功能模块为ViewConroller.m,该应用被加载后开始获取日历,联系人,GPS位置信息以及用户的照片。启动代码如下所示:
enter image description here
所有获取到的信息都会通过RCS系统发送到远程服务器,其RCS模块以RCS开头,传输过程中采用一系列的加密方式,加密模块主要为以NS开头的模块,起后边跟上其加密方式,剩下的还有键盘的实现模块和网络传输模块,如下所示:
enter image description here

0x02 实测行为


将程序编译,然后在手机上运行。安装过后,会创建报刊杂志隐藏应用,长按应用即可显示出来,在设置的应用列表中也可以看到,如下图所示:
enter image description hereenter image description hereenter image description here
点击该应用后,其所有的监控服务就会启动起来,越狱用户是没有任何提示直接启动,而非越狱用户需要添加信任,如下图所示:
enter image description here
但是该黑客团队拥有企业证书,因此它可以通过类似于网络链接的方式引导用户下载安装而不被察觉。
服务一旦启动起来,应用开始请求他所有想获取的数据权限,如下图所示:
enter image description hereenter image description hereenter image description here
同时该应用增加了一个新的键盘,键盘界面和原生的IOS内置键盘相同,因此被攻击用户会在没有察觉的情况下将他们所有的输入信息发送到远程服务器上。键盘如下所示:
enter image description hereenter image description here
需要注意的是,苹果公司针对第三方键盘做了一些保护措施,他不允许第三方键盘运行在具有密码标记的区域,因此该工具并不能够从应用程序和网站中窃取用户的输入密码,但它可以窃取用户名,电子邮件等其他敏感信息。

0x03 感染途径


苹果公司做了大量的工作去保护了非越狱用户远离恶意软件,公共报道的也是监控软件只能去感染越狱的IOS设备,看似非越狱用户是安全的。
Hacking Team拥有苹果的企业证书,而企业证书是由苹果公司发布给企业,并且允许企业不经过appstore审核直接将自己的应用发布到自己的网站上。其他人可以直接下载不用设备授权即可直接安装,并且不限设备上限,因此使得该证书签名的任何应用,不论目标IOS设备是否越狱,都可以安装上。并且该监控工具是一个隐藏的报刊应用,因此可以分发到任何一台IOS设备上。但是苹果公司对此也做了一些安全警告,需要未越狱用户点击信任才可安装,但是从企业网站上下载的应用,用户一般都会忽略掉。
另外还可以通过捆绑越狱工具直接安装到用户手机中,或者通过点击一些下载链接,email等也可以安装在用户设备中。

0x04 总结


苹果公司做了大量的工作去保护了非越狱用户远离恶意软件,公共报道的也是监控软件只能去感染越狱的IOS设备,看似非越狱用户是安全的。而Hacking Team企业证书的滥用导致监控工具恶意传播,对非越狱用户也造成了极大的危害,而苹果公司也在前不久吊销了该团队的企业证书,但是潜在的威胁依然存在,用户在平时下载第三方应用时候也要多注意程序的来源是否可信。
确认自己手机是安装远程监控可通过如下方法查看:
1.检测应用中是否具有空名称的应用程序
2.设置->通用->键盘查看是否有名为app.keyboard的第三方键盘
一些安全建议:
1.添加手机密码。很多间谍软件安全都需要物理接触,添加密码使得它们的攻击更艰难。
2.不要下载来自第三方市场或者链接的应用。
3.尽量不要越狱手机,如果不清楚请求权限的软件是什么,不要添加信任
4.下载安全程序,定期扫描手机系统,如cm security等。

Popular posts from 产品随想的博客

Interview at the All Things Digital D5 Conference, Steve and Bill Gates spoke with journalists Kara Swisher and Walt Mossberg onstage in May 2007.

Kara Swisher: The first question I was interested in asking is what you think each has contributed to the computer and technology industry— starting with you, Steve, for Bill, and vice versa. Steve Jobs: Well, Bill built the first software company in the industry. And I think he built the first software company before anybody really in our industry knew what a software company was, except for these guys. And that was huge. That was really huge. And the business model that they ended up pursuing turned out to be the one that worked really well for the industry. I think the biggest thing was, Bill was really focused on software before almost anybody else had a clue that it was really the software that— KS: Was important? SJ: That’s what I see. I mean, a lot of other things you could say, but that’s the high-order bit. And I think building a company’s really hard, and it requires your greatest persuasive abilities to hire the best ...

产品随想 | 周刊 第43期:历史上的今天

Products Huberman Lab   https://hubermanlab.com/ 一款聚焦于健康的播客 今日热榜   https://tophub.today/ 聚合展示,国内各热门榜单,对跟进热点非常有帮助,热点运营的好帮手 SketchyBar   https://github.com/FelixKratz/SketchyBar A highly customizable macOS status bar replacement Mac菜单栏定制 自定义程度很高,看作者展示的案例,暂时没想出这样的好处(不过应用本身的编辑,确实也没啥意义)生命在于折腾吧! Thanks-Mirror   https://github.com/eryajf/Thanks-Mirror 整理记录各个包管理器,系统镜像,以及常用软件的好用镜像,Thanks Mirror。 Musicn   https://github.com/zonemeen/musicn 一个下载高品质音乐的命令行工具,音乐来源: 咪咕 Planet Minecraft A creative Minecraft community fansite sharing maps, minecraft skins, resource packs, servers, mods, and more. 里面有很多动人的故事 可能是世界上最大的Minecraft社区,从2010年至今 The Uncensored Library   https://www.uncensoredlibrary.com/en blockworks   https://www.blockworks.uk/ "Distinctive maps for Minecraft that have educated players and risen to the level of art" 游戏也可以让人有更高的实现,而不仅仅是沉迷其中,国外游戏厂商比我们做的好太多 Minecraft_Memory_Bypass_GUI   https://github.com/xingchuanzhen/Minecraft_Memory_Bypass_GUI 绕过Minecraft...

巴菲特致股东信-1976年

 笔记: 为什么选择轻资产行业:当竞争疯狂时,不会强迫加入降价大战 最终选择了费雪的思想,选择能理解的优秀企业,以合理的价格买入并长期拥有 翻译: 雪球:https://xueqiu.com/6217262310/131440258 备份:https://archive.ph/XLK0S 原文: To the Stockholders of Berkshire Hathaway Inc, After two dismal years, operating results in 1976 improved significantly. Last year we said the degree of progress in insurance underwriting would determine whether our gain in earnings would be "moderate" or "major." As it turned out, earnings exceeded even the high end of our expectations. In large part, this was due to the outstanding efforts of Phil Liesche's managerial group at National Indemnity Company. In dollar terms, operating earnings came to $16,073,000, or $16.47 per share. While this is a record figure, we consider return on shareholders' equity to be a much more significant yardstick of economic performance. Here our result was 17.3%, moderately above our long-term average and even further above the average o...

Commencement Address at Stanford University--“Stay hungry. Stay foolish.”

I am honored to be with you today for your commencement from one of the finest universities in the world. Truth be told— I never graduated from college. This is the closest I’ve ever gotten to a college graduation. Today I want to tell you three stories from my life. That’s it. No big deal. Just three stories. The first story is about connecting the dots. I dropped out of Reed College after the first six months but then stayed around as a drop-in for another eighteen months or so before I really quit. So why did I drop out? It started before I was born. My biological mother was a young, unwed graduate student, and she decided to put me up for adoption. She felt very strongly that I should be adopted by college graduates, so everything was all set for me to be adopted at birth by a lawyer and his wife. Except that when I popped out they decided at the last minute that they really wanted a girl. So my parents, who were on a waiting...

巴菲特致股东信-1975年

 笔记: 华盛顿邮报已成为伯克希尔第一重仓股 翻译: 雪球:https://xueqiu.com/6217262310/131409324 备份:https://archive.ph/4hgK3 原文: To the Stockholders of Berkshire Hathaway Inc.: Last year, when discussing the prospects for 1975, we stated “the outlook for 1975 is not encouraging.” This forecast proved to be distressingly accurate. Our operating earnings for 1975 were $6,713,592, or $6.85 per share, producing a return on beginning shareholders ’ equity of 7.6%. This is the lowest return on equity experienced since 1967. Furthermore, as explained later in this letter, a large segment of these earnings resulted from Federal income tax refunds which will not be available to assist performance in 1976. On balance, however, current trends indicate a somewhat brighter 1976. Operations and prospects will be discussed in greater detail below, under specific industry titles. Our expectation is that significantly better results in textiles, earnings added from recent acquisitio...

产品随想 | 周刊 第90期:史家之绝唱,无韵之离骚

Why AI Will Save the World   https://a16z.com/2023/06/06/ai-will-save-the-world/ Marc Andreessen的雄文,十分有說服力,邏輯清晰 辯證了現今AI監管拋出的5個可能的AI問題 讀的過程中,腦海裏浮現的都是編程隨想那篇文章 为什么马克思是错的?——全面批判马列主义的知名著作导读   https://program-think.blogspot.com/2018/09/Book-Review-The-Errors-of-Marxism-Leninism.html 兩者的思維鏈條、敘事方式,非常相似 人民聖殿教   https://zh.wikipedia.org/zh-hk/人民圣殿教?useskin=vector 瓊斯自稱是神的化身,幾千年前轉世為釋迦牟尼,創建了佛教;後來又轉世為耶穌基督,創建了基督教;之後短期化身轉世為巴孛,建立巴哈伊信仰;最後轉世為列寧,將社會主義發揚光大。 邪教徒聲稱自己轉世成了列寧,這說明了什麼? Apple Vision   https://stratechery.com/2023/apple-vision Omnivore   https://github.com/omnivore-app/omnivore Omnivore is a complete, open source read-it-later solution for people who like reading. How the YouTube Algorithm Works in 2023: The Complete Guide   https://blog.hootsuite.com/how-the-youtube-algorithm-works/#A_brief_history_of_the_YouTube_algorithm 外人眼中的YouTube推薦算法變遷 Histography   https://histography.io/ “Histography" is interactive timeline that spans across 14 billion years of history, f...

巴菲特致股东信-1973年

 笔记: 在上一年度预测的今年竞争加剧导致利润下滑,真的发生了 翻译Link: 雪球:https://xueqiu.com/6217262310/131257618 备份:https://archive.ph/KIfdT 原文: To the Stockholders of Berkshire Hathaway Inc.: Our financial results for 1973 were satisfactory, with operating earnings of $11,930,592, producing a return of 17.4% on beginning stockholders' equity. Although operating earnings improved from $11.43 to $12.18 per share, earnings on equity decreased from the 19.8% of 1972. This decline occurred because the gain in earnings was not commensurate with the increase in shareholders' investment. We had forecast in last year's report that such a decline was likely. Unfortunately, our forecast proved to be correct. Our textile, banking, and most insurance operations had good years, but certain segments of the insurance business turned in poor results. Overall, our insurance business continues to be a most attractive area in which to employ capital. Management'...

Steve Jobs introduced the iPhone on January 9, 2007.

This is a day I’ve been looking forward to for two and a half years. Link Every once in a while, a revolutionary product comes along that changes everything. And Apple has been— well, first of all, one’s very fortunate if you get to work on just one of these in your career. Apple’s been very fortunate. It’s been able to introduce a few of these into the world. In 1984, we introduced the Macintosh. It didn’t just change Apple, it changed the whole computer industry. In 2001, we introduced the first iPod, and it didn’t just change the way we all listen to music, it changed the entire music industry. Well, today, we’re introducing three revolutionary products of this class. The first one is a widescreen iPod with touch controls. The second is a revolutionary mobile phone. And the third is a breakthrough internet communications device. So, three things: a widescreen iPod with touch controls; a revolutionary mobile phone; and a breakthrough internet communicat...

犀流研习班第十期001-2讲听课笔记

一. 杂谈   1. Max  逼真的效果图和视频   2. SU  显示模式,费力可以作出好看的效果图   3. Maya  支持Nurbs,但不快捷,对CAD导出也不方便

产品随想 | 周刊 第69期:Do not go gentle into that good night

Products Windows Apps That Amaze Us   https://amazing-apps.gitbook.io/windows-apps-that-amaze-us/ 令人精细的Windows App 文物出版社   https://book.douban.com/press/2456/ 这是一个宝藏出版社,出品书籍质量非常高,大开眼界 blind   https://www.teamblind.com/ 老外的匿名职场社交工具,挺有意思,看看硅谷的meme 中国科学技术大学测速网站   https://test.ustc.edu.cn/ 看着还不错,挺靠谱的 底层代码是LibreSpeed   https://github.com/librespeed/speedtest 能不能好好说话?   https://github.com/itorr/nbnhhsh 也是我的一个痛点 Tree Style Tab (aka TST)   https://github.com/piroor/treestyletab 一个超强的浏览器扩展插件,树状呈现浏览器标签 Failory Pitch Decks   https://www.failory.com/pitch-deck 超级多的融资计划投资板,Pitch Book AutoCut   https://github.com/mli/autocut 用文本编辑器剪视频 全网漫游指南   https://tagly.notion.site/tagly/a333efd8c3e54e12b123acd541e8d3e6 数字时代的指引,希望他们成功 IT eBooks   https://it-ebooks.info/ IT书籍下载 ToastFish   https://github.com/Uahh/ToastFish 一个利用摸鱼时间背单词的软件。 利用Win10通知栏,出现、背单词 Ideas 沈向洋:IDEA 如何找到创新的「甜区」   https://mp.weixin.qq.com/s/OlI5VUxQKU_ijWZClQCG0Q AIGC How Did Nor...