Groups > misc.phone.mobile.iphone > #92845

Re: How to check validity of suspicious looking SMS message text URL?

From	Horace Algiers <horace@horacealgiers.com>
Newsgroups	misc.phone.mobile.iphone, alt.os.linux, comp.mobile.android
Subject	Re: How to check validity of suspicious looking SMS message text URL?
Date	2016-09-23 11:44 +0000
Organization	Aioe.org NNTP Server
Message-ID	<ns34iu$qh1$1@gioia.aioe.org> (permalink)
References	<ns2051$15hl$1@gioia.aioe.org> <D409E3CA.7E1AE%usenet@gallopinginsanity.com> <ns270n$qk6$1@news.mixmin.net> <1exxvxx0v4py2$.1vaegndrzrt6a$.dlg@40tude.net>

Cross-posted to 3 groups.

Show all headers | View raw

On Fri, 23 Sep 2016 00:42:21 -0400, tlvp wrote:

> You *do* know who Helmut Kohl is/was, don't you? (Forerunner to Angela
> Merkel.) Dead giveaway this site is *not* on the up-and-up!

There can be *many* Helmut Kohl's just as there are plenty of David
Thompsons, but you are probably correct since everything *else* about that
site was suspect already.

It's not obvious *what* the payload was, but from the URLs kindly provided,
it's obviously something that we should be suspicious of.

The main point though, was *where* to forward these payloads since the
exploits may time out in less than an hour - so we need to have the
forwarding addresses set up *ahead of time*.

Given that companies buy & sell iPhone zero-day exploits openly on the
market (e.g., Zerodium), the most recent set of three Apple zero-day
exploit SMS-link-sent attempts, for example, named "Trident", timed out
after only 1/2 hour, so, one would have to forward the SMishing message to
the "correct" authorities, within that time frame.
https://citizenlab.org/wp-content/uploads/2016/08/image16.png

Others exploits against that same phone expired after the first click, so
that security researchers themselves, had to be the first click - which is,
again, a reason to know, ahead of time, whom to send the links to, as
Mansoor did in the case of the three concurrent iOS zero-day exploits.

In that case, the person who received the message on his stock iPhone 6
running iOS 9.3.3., Mansoor, was prepared and sent it to a security
researcher at "Citizen Lab", who figured out the payload before it expired.
https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/

That payload, which included *3* zero-day exploits, would have allowed the
attackers to remotely "jailbreak Mansoor's iPhone 6 and install spyware to
track his movements, record his WhatsApp and Viber calls, log his messages
and access his microphone and camera."
https://citizenlab.org/wp-content/uploads/2016/08/image10.png

Luckily, within a short period (less than two weeks), Apple patched the
three zero-day exploits in iOS 9.3.5, but many as-yet-unknown zero-day
exploits undoubtably exist in all operating systems.

1. CVE-2016-4657: Visiting a maliciously crafted website may lead to
arbitrary code execution
2. CVE-2016-4655: An application may be able to disclose kernel memory
3. CVE-2016-4656: An application may be able to execute arbitrary code with
kernel privileges

Thread

csiph-web