Connecting the Dots: Kaspersky Reveals In-Depth Insights into Operation Triangulation

Kaspersky’s Global Research and Analysis Team (GReAT) revealed their investigation process into the notorious Operation Triangulation at the recent Security Analyst Summit. The team showcased new details surrounding iOS vulnerabilities and exploits that underpin this assault, providing an analysis of the campaign that has targeted both the public and Kaspersky’s employees.

Earlier this summer, Kaspersky uncovered an Advanced Persistent Threat (APT) campaign targeting iOS devices. Named ‘Operation Triangulation’, this campaign employs a sophisticated method of distributing zero-click exploits via iMessage, ultimately taking complete control over the device and its user data. Kaspersky GReAT assessed that the primary goal may involve covert user surveillance, affecting even Kaspersky’s own staff. Due to the attack’s complexity and the closed nature of the iOS ecosystem, a dedicated cross-team taskforce spent a substantial amount of time and resources conducting a detailed technical analysis.

At the Security Analyst Summit, company experts unveiled previously undisclosed details of the attack chain that took advantage of five vulnerabilities, four of which were previously unknown zero-day vulnerabilities patched after Kaspersky researchers submitted them to Apple.

Company’s experts identified an initial entry point through a font processing library vulnerability. The second, an extremely powerful and trivially exploitable vulnerability in the memory mapping code allowed access to the device’s physical memory. Additionally, attackers exploited two more vulnerabilities to bypass the latest Apple processor’s hardware security features. Researches also discovered that, aside from the capability to remotely infect Apple devices through iMessage without user interaction, the attackers also had a platform to carry out attacks via the Safari web browser. This prompted the discovery and fixing of a fifth vulnerability.

The Apple team has officially released security updates, addressing four zero-day vulnerabilities discovered by Kaspersky researchers (CVE-2023-32434, CVE-2023-32435, CVE-2023-38606, CVE-2023-41990). These vulnerabilities impacted a broad spectrum of Apple products, including iPhones, iPods, iPads, macOS devices, Apple TV, and Apple Watch.

“The hardware-based security features of devices with newer Apple chips significantly bolster their resilience against cyberattacks. But they are not invulnerable. Operation Triangulation serves as a reminder to exercise caution when handling iMessage attachments from unfamiliar sources. Drawing insights from the strategies employed in Operation Triangulation can offer valuable guidance. Additionally, finding a balance between system closedness and accessibility may contribute to an enhanced security posture,” comments Boris Larin, Principal Security Researcher at Kaspersky’s GReAT.

While Kaspersky’s victims include company’s top and middle management as well as researchers based in Russia, Europe and the Middle East, the company was not the only target of the attack.

Alongside the publication of the report and the development of a specialized triangle_check utility, GReAT experts established an email address so any interested party could contribute to the investigation. As a result, company researchers received confirmation of instances where individuals had fallen prey to Operation Triangulation and they provided those victims with the guidance on enhancing their security.

“Securing systems from advanced cyberattacks is not an easy task, and it is even more complicated in closed systems such as iOS. That is why it is so important to implement multi-layered security measures to detect and prevent such attacks,” comments Igor Kuznetsov, Director at Kaspersky’s Global Research and Analysis Team.