Feds take notice of iOS vulnerabilities exploited under mysterious circumstances

The Cybersecurity and Infrastructure Security Agency has ordered federal agencies to patch three critical iOS vulnerabilities that were exploited over a 10-month span in hacking campaigns conducted by three distinct groups.

The hacking campaigns came to light on Thursday in a report published by Google. All three campaigns used Coruna, the name of an advanced hacking kit that amassed 23 separate iOS exploits into five potent exploit chains. While some of the vulnerabilities had been exploited as zero-days in earlier, unrelated campaigns, all had been patched by the time Google observed them being exploited by Coruna. When used against older iOS versions, the kit nonetheless posed a formidable threat given the high caliber of the exploit code and the wide range of capabilities.

The case of the promiscuous 2nd-hand zero-days

“The core technical value of this exploit kit lies in its comprehensive collection of iOS exploits,” Google researchers wrote. “The exploits feature extensive documentation, including docstrings and comments authored in native English. The most advanced ones are using non-public exploitation techniques and mitigation bypasses.”

On Friday, CISA added three of the vulnerabilities to its catalog of known exploited vulnerabilities. The entry requires all federal agencies under CISA’s authority to patch the vulnerabilities. CISA went on to advise all organizations to do the same. The exploits work on iOS versions 13 to 17.2.1. Versions beyond 17.2.1 aren’t vulnerable. The exploits also don’t fire when Apple Lockdown is activated or a browser is set to private browsing.

Advanced capabilities of Coruna include a never-before-seen JavaScript framework that uses a unique obfuscation method to prevent detection and reverse engineering. When activated, the framework runs a fingerprinting module to gather information about a device. Based on the results, the framework would then load a suitable WebKit exploit followed by a bypass for a defense known as pointer authentication code.