"Clues suggest it was originally built for the US government."
Maybe this was the Fisheries Department exploit toolkit.
iVerify, which spun out of Trail of Bits and presumably knows what they're talking about, says it bears "hallmarks" of being connected to USG CNE work. I believe it. But the USG is on net a buyer, not a producer, of CNE tooling. Whatever a given service agency or IC arm buys, dozens of other aligned countries are also buying.
(And, of course, the non-aligned countries have their own commercial supply chains).
I think the notion here is that either:
* There's a shared upstream origin or author between this toolkit and the Operation Triangulation toolkit ahead of the use in Operation Triangulation (ie - someone sold this chain to both the Operation Triangulation authors and a third party). I actually think that the uses of specifically structured code-names internally and the overall structure of the codebase described in the Google writeup make this theory less likely; building an exploit toolkit while using these practices to cosplay as a US-government affiliated engineer would be clever and fun, but it's not something we've really seen before.
* This toolkit originated from (whether it was leaked, compromised, or resold) the same actor who was responsible for Operation Triangulation.
15 chars to spare!
it has a guy working at apple who introduces the subtle vulnerability he is instructed to do
The leap from supply chain interdiction to cooperative insiders isn't a big one.
at the very least use a VPN / more secure phone like a pixel with graphene
You keep doing you though
The fact that there is no option so that any webview by default opens in safari across all app in ios is horrible.
i am not surprised it is riddled with security holes.
I really wish people would understand that VPNs are not magical, unbreakable security. VPNs are barely security at all, and commercial VPNs even less so.
People have been hacking iOS since before it was called iOS and they weren't necessarily "well-resourced, likely state-sponsored". See geohot
oxfeed65261•2h ago