Apple has released updates to address three zero-day vulnerabilities, one of which allowed malicious iMessages to infect devices without user interaction. Two of the vulnerabilities, CVE-2023-32434 and CVE-2023-32435, are being actively exploited to distribute spyware.
CVE-2023-32434 is a kernel bug that enables arbitrary code execution with kernel privileges. Apple has acknowledged that this issue has been exploited on iOS versions released before iOS 15.7.
CVE-2023-32435 is a Webkit bug that leads to remote code execution when processing web content. Apple has also been alerted to active exploitation of this vulnerability.
The discovery of these bugs is credited to researchers from Kaspersky—Georgy Kucherin, Leonid Bezvershenko, and Boris Larin. They have identified the spyware, called TriangleDB, which is deployed on compromised iOS devices after exploiting a kernel vulnerability. The spyware resides in memory, making it undetectable after a device reboot. To reinfect the device, attackers rely on sending a malicious iMessage with an attachment to restart the exploitation chain.
The TriangleDB implant analyzed by Kaspersky possesses commands for interacting with the device’s filesystem (creating, modifying, exfiltrating, and removing files), managing processes (listing and terminating processes), accessing the keychain, monitoring the user’s location, and executing other programs.
The kernel vulnerability affects watchOS 8.8.1 and 9.5.2, macOS Big Sur 11.7.8 and Monterey 12.6.7, iOS 16.5.1, and iPadOS 16.5.1. macOS Ventura 13.4.1, iOS 15.7.7, and iPadOS 15.7.7 are affected by both the kernel bug and the Webkit bug.
In addition to these vulnerabilities, Apple’s recent patches include a fix for another Webkit zero-day, CVE-2023-32439, which can also be triggered by crafted web content and may have been exploited. The specifics of this bug involve a potential hash collision, but further details on its exploitation are not provided.
