DarkSword: zero-click iOS exploit chain described by Google

Google Threat Intelligence Group has described DarkSword, a sophisticated iOS exploit chain that combines multiple vulnerabilities to achieve remote, zero-click compromise. The chain is typically delivered through malicious or compromised websites in watering-hole style attacks. By chaining Safari and WebKit flaws with OS-level components it bypasses iOS protections, enabling arbitrary code execution, sandbox escape and deep device access.

What this means for your organisation

Zero-click attacks remove the user as a line of defence. No amount of training helps against an attack triggered by visiting a website. For Norwegian organisations this matters most for people with access to sensitive information or decision-making authority, whose phones typically hold communication, authentication and documents alike. These are targeted rather than mass attacks, but the consequence for the affected device is total.

Berigo recommends

• Ensure mobile devices are updated quickly, and follow up devices left behind on older versions.
• Consider hardened security modes on phones belonging to executives and particularly exposed key personnel.
• Use mobile device management that gives visibility into version levels and the ability to remove company data.
• Include mobile devices in the incident response plan, with a defined process for suspected compromise.

Source

• cloud.google.com