A vulnerability in the iPhone was discovered in a competition that turned into a monitoring tool against Uyghur Muslims

In March of the year 2017, a group of Chinese hackers arrived in Vancouver, Canada, with one goal: to find hidden weaknesses and loopholes within the most common technologies in the world. Google Chrome, the Microsoft Windows operating system and Apple systems were their target, but no one was breaking the law. , These were just some of the people who participated in Pwn2Own, one of the world's most popular hacking competitions.

Pwn2Own Competition

It was the tenth anniversary of Pwn2Own, a competition that attracts elite hackers and security experts from all over the world with big cash prizes if they find previously undiscovered vulnerabilities known as "zero-days".

 Once the flaw is discovered, the details are handed over to the companies involved, giving them time to fix them. Meanwhile, the hacker gets a monetary reward and eternal bragging rights.

For years, Chinese hackers have been the most dominant forces in competitions like Pwn2Own, taking home millions of dollars in rewards and establishing themselves among the elite. But in 2017, this all stopped.

In a statement, the founder and billionaire CEO of the Chinese cybersecurity giant Qihoo 360 - one of the most important technology companies in China - criticized Chinese citizens who went abroad to participate in hacking contests.

In an interview with the Chinese news site Sina, Zhou Hongyi said that a good performance in such events represents just a "fantastic" success and Zhou warned that once Chinese hackers display weaknesses in overseas competitions, "they cannot be used anymore." Instead, he said, hackers and their cybersecurity expertise should stay in China until they can recognize the true significance and strategic value of software vulnerabilities.

Soon after, the Chinese government banned cybersecurity researchers from attending foreign piracy competitions, and a few months later, a new competition emerged within China to replace international competitions, the Tianfu Cup, as it was called, with prizes worth more than $ XNUMX million.

The inaugural event was held in November 2018, and the grand prize of $ 200000 went to researcher Qixun Zhao, who showed a wonderful series of exploits that allowed him to easily control the latest iPhone devices, and the Chinese researcher found a weakness in the core of the iPhone operating system, which is the kernel. Kernel, and the result?

A remote attacker can take over any iPhone device that has visited a webpage containing the malicious Qixun code, it is the kind of hack that can be sold for millions of dollars in the open market to give criminals or governments the ability to spy on large numbers of people, the researcher called that vulnerability The name "Chaos" and two months later, in January 2019, Apple released an update that fixed the bug, and it's done.

But in August of the same year, Google published an exceptional analysis of a piracy campaign that it said was exploiting iPhones collectively. Researchers dissected five distinct chains of exploit chains that they discovered. This vulnerability included Qixun that won the first prize in Tianfu, and which was discovered by another hacker. .

Google researchers pointed out similarities between the attacks used in the real world and the Chaos vulnerability. But they did not seem interested in knowing the identity of the victim and the perpetrator, the victim was Uyghur Muslims and the attack by the Chinese government.

Crackdown

Over the past seven years, China has committed human rights violations against Uyghurs and other minority groups in western Xinjiang Province. Well-documented aspects of the campaign include concentration camps, systematic forced sterilization to prevent childbirth, torture, organized rape, forced labor, and unparalleled surveillance efforts.

Officials in Beijing argue that China is working to combat terrorism and extremism, but the United States, among other countries, has described these measures as genocide, adding the violations to an unprecedented high-tech crackdown that is dominating the lives of Uyghurs, relying in part on targeted piracy campaigns.

China's piracy of Uyghurs is so aggressive that it extends far beyond state borders, and journalists, dissidents, and anyone who raises Beijing's suspicions of insufficient loyalty are targeted.

Shortly after Google researchers noticed the attacks, Apple published a rare blog post on its media blog It confirmed that the attack took place over a period of two months, that is, the period that began immediately after Qixun won the Tianfu Cup and extends until Apple issued the reform.

Apple says that the Uyghur Muslims in China have been targeted in the recent hacking campaign on iPhones, and the Americans have concluded that the Chinese have mainly followed the "strategic value" plan developed by Zhou Hongyi of Qihoo, in which the Tianfu Cup is used to find new vulnerabilities and is done. She was quickly handed over to Chinese intelligence, who then used her to spy on the Uyghurs.

Finally, these vulnerabilities are of incredible value, not just financially, but in terms of their ability to create an open window for espionage and repression, as happened with Uyghur Muslims when they were tracked and monitored in real time.

Source:

technologyreview