Operation Triangulation: zero-click iMessage spyware on Kaspersky's iPhones
Apple iOS (and other Apple OSes sharing the bugs)
Kaspersky found a years-long zero-click iMessage campaign on its own staff's iPhones. The chain used several Apple zero-days, including a bypass of hardware memory protections through undocumented MMIO registers (CVE-2023-38606), which was revealed at 37C3 in December 2023.
Why this severity: Zero-click spyware chain, actively exploited (CISA KEV)
- Started
- Jun 1, 2023
- Closed
- Dec 27, 2023
Affected
- Exploited against iOS versions before iOS 15.7 / 15.7.1 (NVD)
Fixed in
- CVE-2023-32434: iOS 16.5.1, iOS 15.7.7, macOS Ventura 13.4.1, Monterey 12.6.7, Big Sur 11.7.8, watchOS 9.5.2, 8.8.1 (NVD)
- CVE-2023-32435: iOS 16.4, iOS 15.7.7, macOS Ventura 13.3, Safari 16.4 (NVD)
- CVE-2023-38606: iOS 16.6, iOS 15.7.8, macOS Ventura 13.5, Monterey 12.6.8, Big Sur 11.7.9, tvOS 16.6, watchOS 9.6 (NVD)
Updates by day4
▸Dec 27, 2023
Link #At 37C3, Kaspersky details the hardware-feature bypass behind CVE-2023-38606
Source
▸Jul 24, 2023
Link #Apple fixes CVE-2023-38606 (iOS 16.6); KEV entry follows on July 26
Source
▸Jun 21, 2023
Link #Apple fixes CVE-2023-32434 and CVE-2023-32435; CISA adds them to KEV on June 23
Source
▸Jun 1, 2023
Link #Kaspersky discloses Operation Triangulation
Source
Advisories4
News & write-ups2
Notes & caveats
The chain also used CVE-2023-41990 (TrueType, added to KEV in January 2024, so not listed here).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
