Hackers used 11 zero-day exploits, compromised websites to infiltrate iOS, Android, and Windows

Detailed in a blog post by Google’s Project Zero team about what is being called a highly sophisticated attack, a group of hackers leveraged a total of 11 zero-day vulnerabilities along withf compromised websites to infect fully patched devices running iOS, Windows and Android. The hacks began in February 2020 and continued for at least eight months, the Project Zero team says.

Dan Goodin for Ars Technica:

The hackers’ ability to chain together multiple exploits that compromised fully patched Windows and Android devices led members of Google’s Project Zero and Threat Analysis Group to call the group “highly sophisticated.”

The ability to pierce advanced defenses built into well-fortified OSes and apps that were fully patched—for example, Chrome running on Windows 10 and Safari running on iOS—was one testament to the group’s skill. Another testament was the group’s abundance of zero-days. After Google patched a code-execution vulnerability the attackers had been exploiting in the Chrome renderer in February, the hackers quickly added a new code-execution exploit for the Chrome V8 engine.

Thursday’s post offered no details on the group responsible for the attacks. It would be especially interesting to know if the hackers are part of a group that’s already known to researchers or if it’s a previously unseen team. Also useful would be information about the people who were targeted.

MacDailyNews Take: Sounds state-sponsored.

Google’s Project Zero blog post is here.