Hello, world!
For almost a year, a vulnerability in iOS enabled advanced spyware to hack iPhones using
nothing more than a malicious Calendar invite.
It was being actively exploited by governments
all around the world to allegedly target journalists
and political activists.
Now, if this all sounds like the work of an Israeli spyware company, well, that’s because
it is - allegedly, of course.
The company in question, is called Quadream - they’ve gone under the radar for years.
These guys don’t want you to know they even exist, they have no social media presence,
they don’t have a logo, these guys don’t even have a website.
This is all in a bid to avoid the mistakes of NSO Group - an Israeli spyware company
you probably have heard about, their suite of spyware tools going by the name Pegasus
has made them world famous, for all the wrong reasons.
In particular they made headlines when their spyware was allegedly used by the Saudis to
aid in the assassination of a journalist.
At one point several of NSO group’s employees broke away to form their own company, Quadream.
But, apart from having what is probably the shortest wikipedia page you’ve ever seen,
there’s little evidence that Quadream even exists.
But that all changed a few days ago, when reports from Microsoft and the Canadian research
institute, CitizenLab exposed the company’s operations.
The reports explain, that just like NSO group, Quadream’s customers could deploy their
spyware through zero-click exploits, as in a hack that required no interaction at all
on the part of the victim.
One of which, the researchers dubbed “ENDOFDAYS” - it exploits the iOS calendar app.
You see, whenever an iPhone receives a Calendar invite set for a date in the past, it’s
automatically added to the phone’s Calendar, without any prompt or notification - it just
happens in the background.
This is a pretty dangerous oversight on Apple’s part, because it served as a way to get an
iPhone to do something without it’s owner’s knowledge.
Regardless of what that something is, in this case adding an event to someone’s Calendar
- if a vulnerability could be found in this very process, then it could potentially be
exploited.
And, well - that’s exactly what Quadream did, it turns out Apple didn’t properly
sanitise these Calendar invites, which come in the form of ‘.ics’ files, making possible
an XML escape attack, as in, malicious code could be embedded within the invite, which
would run on the victim’s phone all without their knowledge.
This vulnerability was fixed in iOS 14, but up until then, the ‘ENDOFDAYS’ exploit
was packaged within Quadream’s suite of spyware called ‘REIGN’.
The capabilities of ‘REIGN’ are pretty much exactly what we’ve come to expect from
commercial spyware, ‘REIGN’ could record calls, audio, hijack the camera, exfiltrate
saved passwords.
And, interestingly, it could also generate iCloud 2FA passwords - something I don’t
think Pegasus could even do.
This means the spyware’s operators could generate 2FA codes for arbitrary future dates,
facilitating persistent access to a victim’s iCloud account.
‘REIGN’ could also do other standard spyware things, like search through files, clean it’s
traces and of course track its victims’ location.
As for the customers of REIGN?
Researchers fingerprinted servers commanding this spyware operating all over the world
- suggesting that the governments of these countries make up Quadream’s clientele.
But who did these government’s target with REIGN spyware?
Well, CitizenLab identified five victims, including “journalists, political opposition
figures and NGO workers”, though we’ll never know the full extent of those targeted.
It was pretty easy to discover who was victimised with that Calendar exploit, because all the
malicious Calendar events shared the same name, “Meeting” and description, “Notes”.
But the researchers did discover other ways of detecting the spyware even after it had
cleaned it’s traces, which they’re calling “The Ectoplasm Factor” - but details of
this aren’t being disclosed as it “may be useful for tracking QuaDream’s spyware
going forward”.
Non disclosure of this kind isn’t unusual, Apple does something similar, as if you’re
unlucky enough to be served a “Threat notification’
from Apple - indicating that you’ve been
the target of advanced state-sponsored spyware, this banner is all you’re going to get,
Apple won’t disclose any details “as that may help state-sponsored attackers adapt their
behaviour to evade detection in the future”.
But regardless of CitizenLab’s decision not to disclose this “Ectoplasm factor”,
it really doesn’t matter - because just as I was wrapping up this video, is was announced
that Quadream is actually shutting down for good, the reason?
Well, according to Quadream the entire spyware industry is in crisis.
Which “began due to the public disclosure of the activities of some … companies from
2018 onwards”, which resulted in the “US Chamber of Commerce” blacklisting some of
these spyware companies, which in turn spooked Israeli regulators into reducing “the number
of countries that spyware is allowed to be sold to”, [causing] a severe economic crisis
in the entire industry” and leading to the demise of Quadream.
In other words the fact that enough people care about the revelations surrounding commercial
spyware has caused real changes which have in turn made it way more difficult for these
companies to even operate.
Resulting in the downfall of this spyware company.
This video is brought to you by PlexTrac, who’re offering you a FREE one month trial
of their premier cybersecurity reporting and collaboration platform.
Get started today to learn why the best offensive security teams trust PlexTrac.
PlexTrac empowers users to build better reports in half the time, exponentially increasing
ROI and time savings, To aggregate findings from all their tools by consolidating the
testing process into one platform, creating a single source of truth, and to maximize
their reusable report content, like findings writeups and narratives, improving consistency
across the team.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement.
Ready to elevate your reporting, improve collaboration
across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
You’ve probably noticed the past few videos have been covering single topics instead of
the usual 3 topics.
Now, I realised a good chunk of people only watch the first segment in those three segment
videos, which is understandable given the title doesn’t allude to them, and can’t
since I’ve only got a few dozen characters to play with.
So I’ll be doing single topic videos for a while as a bit of a test, hopefully this
should allow me to get more videos out than usual and flesh out each topic a bit more,
but of course ifI’m interested to hear what you guys think so if you’ve got any thoughts
do let me know down below.
As always thanks for watching, and stay tuned for more hacking videos, have a good one.