Stefan Mileschin

Competition winner

An attack that targeted Apple devices was used to spy on China's Muslim minority -- and US officials claim it was developed for the country's top hacking competition.

The Tianfu Cup offered prizes that added up to over a million dollars. The competition was held in November 2018, shortly after the Chinese banned cybersecurity researchers from attending overseas hacking competitions.

The $200,000 top prize went to Qihoo 360 researcher Qixun Zhao, who showed off a remarkable chain of exploits that allowed him to easily and reliably take control of even the newest and most up-to-date iPhones.

This was mostly thanks to a weakness in the iPhone kernel which meant that a remote attacker could take over any iPhone that visited a web page containing Qixun's malicious code.

Two months later, in January 2019, which was super quick for Jobs' Mob, Apple issued an update that fixed the flaw. There was little fanfare—just a quick note of thanks to those who discovered it. But in August of that year, Google published an extraordinary analysis into a hacking campaign it said was "exploiting iPhones en masse".

Researchers dissected five distinct exploit chains they had spotted "in the wild". These included the exploit that won Qixun the top prize at Tianfu, which they said had also been discovered by an unnamed "attacker".

The Google researchers pointed out similarities between the attacks they caught being used in the real world and Chaos. The victims and the attackers were Uighur Muslims and the Chinese government.

Apple published a rare blog post that confirmed the attack had taken place over two months: that is, the period beginning immediately after Qixun won the Tianfu Cup and stretching until Apple issued the fix.

It turns out that United States government surveillance independently spotted the Chaos exploit being used against Uyghurs, and informed Apple which had decided to rush out a patch.

The Americans concluded that the Chinese essentially followed the "strategic value" plan laid out by Qihoo's Zhou Hongyi; that the Tianfu Cup had generated an important hack and that the exploit had been quickly handed over to Chinese intelligence, which then used it to spy on Uighurs.
https://fudzilla.com/news/mobile/528...uyghur-muslims