Spyware vendors use 0-days and n-days against Android, iOS and Chrome

Can we change the link to the official blog post, which has more details? <a href="https:&#x2F;&#x2F;blog.google&#x2F;threat-analysis-group&#x2F;spyware-vendors-use-0-days-and-n-days-against-popular-platforms&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.google&#x2F;threat-analysis-group&#x2F;spyware-vendors-us...</a>

From the <a href="https:&#x2F;&#x2F;blog.google&#x2F;threat-analysis-group&#x2F;spyware-vendors-use-0-days-and-n-days-against-popular-platforms&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blog.google&#x2F;threat-analysis-group&#x2F;spyware-vendors-us...</a><p>&gt; In November 2022, TAG discovered exploit chains with 0-days affecting Android and iOS that were delivered via bit.ly links sent over SMS to users located in Italy, Malaysia and Kazakhstan. When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page to track shipments for Italian-based shipment and logistics company BRT or a popular Malaysian news website.<p>You can harden your iPhone&#x2F;iOS from a cyberattack with Lockdown Mode[0]. It blocks those clickable links and removes many other attack vectors <a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-gb&#x2F;guide&#x2F;iphone&#x2F;iph049680987&#x2F;ios" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;en-gb&#x2F;guide&#x2F;iphone&#x2F;iph049680987&#x2F;io...</a> However, I&#x27;m unsure if an attacker could bypass Lockdown Mode with additional bugs on iOS.<p>[0] <a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-sg&#x2F;HT212650" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;en-sg&#x2F;HT212650</a>

n-days. you mean &quot;known and disclosed issues which we choose not to make fixes available to 80% of our clients so we can sell more disposable pocket computers.&quot;

This is convincing me that iOS users should enable Lockdown Mode, irrespective of whom they may be.

&gt; These vendors are enabling the proliferation of dangerous hacking tools, arming governments that would not be able to develop these capabilities in-house.<p>I wonder what this means? Why does it matter if the nation couldn&#x27;t make the tool themselves?<p>I might be reading into it. But is there an idea that technological sophistication itself imbues morals? And these unsophisticated nations are amoral?<p>Or maybe even a might is right mindset?<p>I&#x27;m surely reading too much into this but for whatever reason it stood out to me.

&gt; When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page to track shipments for Italian-based shipment and logistics company BRT or a popular Malaysian news website.<p>So at least this is not a 0-click exploit<p>I&#x27;m an Android Pixel (5a) user, how does this affect me...<p>&gt; The Android exploit chain targeted users on phones with an ARM GPU<p>according to Wikipedia, my Pixel 5a has an Adreno 620 GPU made by Qualcomm so looks like I&#x27;m safe there. Curious to know which phones use the ARM GPU, not sure if this is a complete list but I found this[0] on an ARM website. Looks like Pixel 6 and 7 are affected since they use the Tensor chip which are ARM64 based.<p>&gt; running Chrome versions prior to 106.<p>Current Chrome for Android version on my phone is 111.0.5563.116. The earliest version of Chrome for Android version 106 I can find is late Sept 2022[1], so not super long ago but it was at least fixed back in Sept.<p>&gt; Note, Pixel devices with the 2023-01-05 security update are protected against both exploit chains in this blog.<p>My last security update was 2023-03-05 (and I mentioned my Chrome version above) so I&#x27;m protected<p>&gt; Chrome users updated to at least version 108.0.5359 are also protected.<p>So which is it? affects users of Chrome prior to 106 yet you need to be on Chrome 108 to be protected? This is a bit confusing. Looks like Chrome for Android v108.0.5359.x was released late November 2022[2].<p>Just needed to do that for peace of mind. I understand that Google wouldn&#x27;t be posting this if they hadn&#x27;t at released a fix for this and handled their Pixel phones.<p>I really wish there was some kind of database where I can look up a phone model and see a list of exploits and whether they have been patched or not, at least when they are hardware and&#x2F;or OS related.<p>0. <a href="https:&#x2F;&#x2F;developer.arm.com&#x2F;Tools%20and%20Software&#x2F;Arm%20Mobile%20Studio#Supported-Devices" rel="nofollow">https:&#x2F;&#x2F;developer.arm.com&#x2F;Tools%20and%20Software&#x2F;Arm%20Mobil...</a><p>1. <a href="https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2022&#x2F;09&#x2F;chrome-for-android-update_01538182103.html" rel="nofollow">https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2022&#x2F;09&#x2F;chrome-for-and...</a><p>2. <a href="https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2022&#x2F;11&#x2F;chrome-for-android-update_29.html" rel="nofollow">https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2022&#x2F;11&#x2F;chrome-for-and...</a>

Am I right in that these were fixed (at least in iOS), some time ago?<p><a href="https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-42856" rel="nofollow">https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2022-42856</a><p><a href="https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2021-30900" rel="nofollow">https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2021-30900</a>

This is the real threat of these large AI models. They will revolutionize the ability to find vulnerabilities.<p>Especially if we achieve AGI.

So,<p>Safe in Chrome since November 2022<p>Safe in Ios since November 2021

Is there any indication if iOS’s Lockdown Mode[0] would have stopped these exploit chains?<p>[0] <a href="https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT212650" rel="nofollow">https:&#x2F;&#x2F;support.apple.com&#x2F;en-us&#x2F;HT212650</a>

&gt; location and install .IPA files<p>??? Did they mean APK file?

what about firefox ?

Captain obvious strikes again.

This is another one of those cases that seems to be completely nullified by keeping JS off by default and whitelisting it only on sites you really trust.<p>But of course the biggest spyware company in the world relies on the same to track its users.

A hardware exploit on one browser and a web based exploit are not even on the same level.<p>Instead of lumping all of Android, just name the brands with hardware issues. IMO its clickbait. I don&#x27;t use both the phones listed and the web browser listed. But hey, they got me to click. I&#x27;m already getting desensitized.