Top stories.
- DarkSword exploit chain compromises iOS devices.
- Ubiquiti fixes a maximum-severity UniFi vulnerability.
- CISA urges organizations to secure Intune accounts following Stryker attack.
DarkSword exploit chain compromises iOS devices.
WIRED reports that a new iOS exploit chain and payload called "DarkSword" allows infected websites to silently compromise iOS devices that visit the sites. iVerify, Lookout, and Google jointly published their own reports on the technique yesterday. Google says the suspected Russian espionage group UNC6353 recently began using DarkSword in watering-hole campaigns targeting Ukrainian users.
Lookout explains, "DarkSword is a complete exploit chain and infostealer written in JavaScript. It leverages multiple vulnerabilities to establish privileged code execution to access sensitive information and exfiltrate it off the device. The kill chain begins with Safari encountering the malicious iframe embedded in a web page. Once loaded, Darksword breaks out of the WebContent sandbox and then leverages WebGPU to inject into mediaplaybackd. From there it can craft Kernel read/write access, which it leverages to gain access to privileged processes and modify sandbox restrictions, gaining access to restricted parts of the filesystem."
DarkSword is effective against devices running iOS 18 or earlier, meaning nearly a quarter of iPhones are vulnerable to the attack. iVerify cofounder and researcher Matthias Frielingsdorf notes that the Russian hackers who most recently used the exploit carelessly left the full code exposed on their sites, meaning "[a]nyone who manually grabbed all the different parts of the exploit could put them onto their own web server and start infecting phones."