Operation Poisoned News: Hong Kong Users Targeted with Mobile Malware via Local News Links

Technical Brief

By Elliot Cao, Joseph C. Chen, William Gamazo Sanchez, Lilang Wu, and Ecular Xu Contents

1 Attack Chain

1.1 Watering hole attack tactic

1.2 Infection chain

2 Exploits Analyses

2.1 The JavaScriptCore exploit

2.1.1 Bug triggering

2.1.2 The addrof/fakeobj primitives

2.1.3 Arbitrary address read/write primitive

2.1.4 Shellcode execution

2.2 Kernel exploit

3 iOS Malware lightSpy

3.1 Startup loader

3.2 Light: The main malicious control agent

3.3 BasicInfo module (Command ID 11000)

3.4 ShellCommandaaa module (Command ID 20000)

3.5 KeyChain module (Command ID 31000)

3.6 Screenaaa module (Command ID 33000)

3.7 SoftInfoaaa module (Command I…