4

This article tells us that the NightSkies tool may have been put on iPhones enroute before distribution. While there have been many iPhones, architectures, and security updates since 2008, is there a way to detect firmware toolsets like this one?

The NightSkies documentation published by WikiLeaks, which is dated July 7, 2008, describes how to install the tool on “factory fresh” devices. WikiLeaks interpreted that to mean the CIA infects devices within Apple’s supply chain before they ever are received by a user.

2

The only real way to compare if a firmware image has been modified is to be able to take the firmware from the device, take a hash of it, and compare it to the hash of a known good copy.

The image taken from the device must be obtained in such a way that any malware on the device can't tamper with the image being exported (i.e. obtain the image before the system boots). I'm not too familiar with iPhone forensic tools, so I couldn't tell you the cost to do something like this.

Do you have reason to believe you would be targeted by the CIA? The reason I ask is because the more often tools like NightSkies are deployed, the sooner they will be detected, and will lose their value. Intelligence agencies choose their targets carefully for this reason. What was most likely occurring was interdiction; essentially, grabbing the device out of the mail before it went to the user, installing the malware, and then putting it back in the mail. To summarize, if you or the organization you work for are not a target, you shouldn't worry about it too much.

  • No, not a target (well, maybe now I am. ;) If intercepted in the supply chain it could have gone anywhere but only activated if necessary to prevent breaking US laws. Do you know if subsequent iPhones have any sort of signing or runtime checks for the BIOS/firmware? – Tracy Cramer Mar 23 '17 at 22:48
  • @TracyCramer iOS indeed has firmware signature checks (the boot loader wouldn't run unsigned software, and even installing signed software needs a signature from Apple's servers) but it can be defeated with physical access and enough effort. – André Borie Sep 20 '17 at 7:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.