Kaspersky: iPhone hackers exploited previously unknown hardware feature in soc

Hackers have exploited a previously unknown hardware feature in Apple smartphones for malware. That’s what security researchers at Kaspersky say. It’s not clear what the hardware function did. The malware allowed hackers to steal personal data.

The ‘hardware feature’ allowed the hackers to bypass the hardware security measures of Apple devices and gain access to parts of the memory that would normally be shielded. The security researchers say that the hardware function was previously unknown, complicating research into the security problem. To investigate the malware, researchers had to reverse engineer the hardware and software of iPhones. Kaspersky says the hardware feature may be intended for testing or debugging use.

The malware was part of a campaign Kaspersky calls Operation Triangulation and worked with zero-click exploit messages via iMessage. The attackers sent an iMessage message to the intended victim, after which the malware was able to take over the device and steal data without any user action. The malware was able to infect not only iPhones, but also other Apple devices. The malware used four zero days that have now been patched by Apple. The zeroday that used the hardware function was CVE-2023-38606.