Spyware Vendors Caught Exploiting Zero-Day Vulnerabilities on Android and iOS Devices

Mar 29, 2023Ravie LakshmananZero-Day / Mobile Security

A number of zero-day vulnerabilities that were addressed last
year were exploited by commercial spyware vendors to target Android
and iOS devices, Google’s Threat Analysis Group (TAG) has
revealed.

The two distinct campaigns were both limited and highly
targeted, taking advantage of the patch gap between the release of
a fix and when it was actually deployed on the targeted
devices.

“These vendors are enabling the proliferation of dangerous
hacking tools, arming governments that would not be able to develop
these capabilities in-house,” TAG’s Clement Lecigne said^[1]
in a new report.

“While use of surveillance technologies may be legal under
national or international laws, they are often found to be used by
governments to target dissidents, journalists, human rights
workers, and opposition party politicians.”

The first of the two operations took place in November 2022 and
involved sending shortened links over SMS messages to users located
in Italy, Malaysia, and Kazakhstan.

Upon clicking, the URLs redirected the recipients to web pages
hosting exploits for Android or iOS, before they were redirected
again to legitimate news or shipment-tracking websites.

The iOS exploit chain leveraged multiple bugs, including
CVE-2022-42856^[2]
(a then zero-day), CVE-2021-30900^[3], and a pointer
authentication code (PAC^[4]) bypass^[5], to install an .IPA
file^[6] onto the susceptible
device.

The Android exploit chain comprised three exploits – CVE-2022-3723^[7], CVE-2022-4135^[8]
(a zero-day at the time of abuse), and CVE-2022-38181^[9]
– to deliver an unspecified payload.

While CVE-2022-38181, a privilege escalation bug affecting Mali
GPU Kernel Driver, was patched by Arm in August 2022, it’s not
known if the adversary was already in possession of an exploit for
the flaw prior to the release of the patch.

Another point of note is that Android users who clicked on the
link and opened it in Samsung Internet Browser were redirected to
Chrome using a method called intent redirection^[10].

The second campaign, observed in December 2022, consisted of
several zero-days and n-days targeting the latest version of
Samsung Internet Browser, with the exploits delivered as one-time
links via SMS to devices located in the U.A.E.

The web page, similar to those that were used by Spanish spyware
company Variston IT^[12], ultimately implanted a
C++-based malicious toolkit capable of harvesting data from chat
and browser applications.

The flaws exploited constitute CVE-2022-4262^[13], CVE-2022-3038^[14], CVE-2022-22706^[15], CVE-2023-0266^[16], and CVE-2023-26083^[17]. The exploit chain is
believed to have been used by a customer or partner of Variston
IT.

That said, the scale of the two campaigns and the nature of the
targets are currently unknown.

The revelations come just days after the U.S. government
announced an executive order^[18] restricting federal
agencies from using commercial spyware that presents a national
security risk.

“These campaigns are a reminder that the commercial spyware
industry continues to thrive,” Lecigne said. “Even smaller
surveillance vendors have access to zero-days, and vendors
stockpiling and using zero-day vulnerabilities in secret pose a
severe risk to the Internet.”

“These campaigns may also indicate that exploits and techniques
are being shared between surveillance vendors, enabling the
proliferation of dangerous hacking tools.”