Internal attackers account to be 43 percent of data breach !!!

Although companies are always at risk for data security threats from the external hackers, employee activities cause a fair share of data breaches, too; simply cause people within the organizations do not understand the consequences of their erroneous actions or habit related to their company systems or critical data is alike if not excessive risk. 

Every person within their organization has an access to some or the other company information which causes unauthorized release of data from within network. It is also seen that, although companies have protocols in place to prevent data breaches, many employees often break company policy. 53% of companies said employees use company-issued devices to send business-related information to personal email and cloud-based file-sharing accounts, such as Gmail and DropBox.

And for this reason, proper education for all the members of the organisation that encourages IT security safety is extremely important. Investing in security awareness sessions, professional development & trainings for existing staff can help to boost security. For anyone to stay ahead of hackers, people need to be up-to-date on this front.

Hackers will always be out there, adapting to the newest & most multifarious technology to set their targets. To counteract data breaches, we need to first work on the root cause of the problem i.e. invest in security and more emphasize the importance of education. 

What do you think on this? Where to start with?

Take the below easy steps and there you are:

1) Awareness sessions about how a hacker can get in and poach your sensitive data

On an average, employees are aware of most likely keywords - virus, firewalls, malware, ransomware, cyberattacks, threats - but here again what does it all means has to explained to them at a basic level along with the consequences of the same. More highlighted area would be on how an external attacker can use them to get access to the company data.   

2) Improvising employees erroneous actions

IT practices, protocols & polices could be well defined & handed over to the employees on the initial front itself. Very high chances, that won't come up with a surprise to you is of people violating these rules & policies set. For e.g.: Strict NO for attaching company files to any personal emails, uploading company files to cloud based sharing accounts, transferring data on non-encrypted USB's, etc. 

For this yearly security awareness training & recapping sessions should be done as a part of company approach.  

3) To lead people, walk besides them

By walking your talk, you become a person others want to follow. When leaders say one thing, but do another, they erode trust--a critical element of productive leadership. 

As we all know, mostly management scares their employees into following policies but sometimes they tend to ignore it by themselves. The major turning issue here could be that if a manager violates a company policy while interacting with their employees, higher chances of employees do following the same path at their time of action. Showing employees that their concerns are a part of the IT security strategy is important because it diminishes the feeling that the policies are implemented to restrict them.

General things to be undertake would be likely:

• Elect who can access various systems and easily turn off someone’s access when it’s no longer needed.

• Regular password changes for highly sensitive accounts.

• Frequently rotate passwords to prevent brute-force or offline cracking attacks.

• Administer OTP's that will expire after a set period of time.

• Require users to present multiple types of authentication (two factor authentication) when logging into certain accounts.

Your mind is a storage room full of information, keep the door locked.
 THINK before you CLICK, CONNECT & DOWNLOAD 

Another data breach that catches the eyeballs this week is LinkedIn's Lynda.com

Though the passwords were more or less secure, but the training site isn't taking any risk.

Many of us would want to check our Lynda account on LinkedIn, whether we have one, & as it is in broadcast that it has been penetrated or something.

Less than a week after Yahoo confirmed a second data breach affecting nearly one billion users, another online social network has been targeted by hackers.

LinkedIn bought Lynda.com in April last year in a cash and stock deal valued at approximately $1.5 billion.
In June, LinkedIn was acquired by Microsoft in an all-cash transaction worth $26.2 billion.

In September, LinkedIn publicized the LinkedIn learning availability, which was a combination of Microsoft's resources with Lynda.com's content and LinkedIn's massive trove of professional and networking data.

LinkedIn's training site - Lynda.com is notifying users of a database breach that includes the passwords of just under 55,000 accounts — is the latest hack attack victim, although with a much lower number of affected victims.

During this, LinkedIn began notifying Lynda.com's 9.5 million users that an unauthorized third party had recently access a database containing customer information, their learning data & courses information.

“We are informing you of this issue out of an abundance of caution, while we have no evidence that your specific account was accessed or that any data has been made publicly available, we wanted to notify you as a precautionary measure" Lynda.com said in a notice to users.

Google Accounts Hacked !! More than a million...

The security research team of Check Point revealed that a new Android malware, dubbed as Gooligan, breached security of more than a million Google accounts and the number is increasing by 13000 every day.

The malware roots infect devices and steals authentication tokens stored on them. The hackers then are able to access data from Google Play, Gmail, Google Photos, Google Docs, G Suite, Google Drive, and more.

This malware, Gooligan, mostly affects devices on Android 4 and 5. It is found that the fake applications looked apparently legitimate and once downloaded and installed by an Android user, the malware will start sending the stolen data from the user’s devices to its Command and Control (C&C) server.

Gooligan then downloads a rootkit from the C&C server that takes advantage of multiple Android 4 and 5 exploits including the well-known VROOT (CVE-2013-6282) and Towelroot (CVE-2014-3153), report the researchers.

This module injects code into running Google Play or GMS (Google Mobile Services) to mimic user behaviour so that Gooligan can avoid detection. The module allows Gooligan to:

1) Steal a user’s Google email account and authentication token information. 

2) Install apps from Google Play and rate them to raise their reputation

3) Install adware to generate revenue

An online web tool,  https://gooligan.checkpoint.com/ --  has been created by Check Point to check if your Android device has been infected with Gooligan virus.  To find this, after opening “Gooligan Checker”, just enter google email ID.  If the device shows infected, you are recommended to run a clean installation of the operating system, by a certified technician or mobile service provider, on your Android device.

San Francisco Metro System hacked with Ransomware

The San Francisco Municipal Transport Agency (SFMTA) said “on Nov. 25, the SFMTA was a victim of a ransomware attack,” and “the situation is now contained, and we have prioritized restoring our systems to be fully operational.” More than 2000 computer and payment systems were affected. According to the San Francisco Examiner, SFMTA confirmed a Ransomware attack against the station fare systems, causing to shut down of ticket kiosks and make rides free this weekend. Nearly 30 GB of sensitive data, including databases and employee information were under threat.

On the screen of SFMTA computer system, the message displayed was “You Hacked, ALL Data Encrypted. Contact For Key(cryptom27[@]yandex.com)ID:681, Enter”.

The attackers purportedly used the ransomware HDDCryptor, also known as Mamba, to carry out the attack. The ransomware is unique, in the sense that it encrypts a target’s hard drive rather than individual files.

The target machine is typically infected by accidentally opening a malicious executable in an email or download, and then the malware spreads out across the network.

The attackers were demanding a ransom of roughly $73,000 to restore the SFMTA computer system.

In an email exchange the attacker wrote: “We Don’t live in USA but I hope Company Try to Fix it Correctly and We Can Advise Them But if they Don’t , We Will Publish 30G Databases and Documents include contracts , employees data , LLD Plans , customers and… to Have More Impact to Company To Force Them to do Right Job!”

The spokesperson of SFMTA, Paul Rose, denied the allegations of attackers, and told that customer privacy and transaction information were in order. He further said that “we have never considered paying ransom and don’t intend to”. He also said that they are investigating the matter and "working to resolve the situation,"

The identity of hackers and the extent at which the threat happened are all a secret at present.  But the everyday instances remind us as to how far vulnerable our infrastructure is.

What every organization MUST-DO for Cybersecurity !!

Not a single day passes without reporting about cybersecurity breach in one way or other. Whether large or small companies, there is no escape from cyber attacks.

The scope, according to Norman Van, towards cyber security of an organization, is meant for confidentiality, availability and integrity of data. Information Systems are the sum total of data collections and associated persons, procedures, processes and software as well as the provision for the information system for storing, processing and communication.

Some of the basic threats –

We are listing below some of the important basic threats to be attended to in respect of cyber security. Every organization must pay attention to these basics to stay away from cyber security threats.

Ø  Secure Websites and web apps against attacks and malware infection.

Ø  End points are like open door, and hence, security measures must be implemented to safeguard user devices against virus, intrusion, browser etc.

Ø  Social networking has become apparently smart and complex, and hence, phishing attacks are very powerful and organized, and are to be prevented.

Ø  There are always loopholes or vulnerabilities in the software which are always aimed by attackers.  Hence, necessary patch works must be done to keep abreast of times.  A great majority of exploitation was on old software.

Ø  Data breaches involving employees is one of the common occurrences, hence it should be checked.

Ø  Implementation of effective password is absolutely necessary.  Refer our earlier blog where its flaws and remedies are suggested.

Ø  Vis-a-vis growth of smart devices, and cloud services, security threats of IOTs also increased significantly, hence, information security is very essential.

Ø  Encryption and DLP should be used to safeguard sensitive data, and restriction should be imposed on the use of unauthorized devices like USB, extra portable hard drives etc.

Ø  Once a website is attacked, critical information would be lost, hence back up system would be adopted.

Cybersecurity is not a onetime job.  It is a continuous process.  Due to advancement of technology, new techniques are tried every time by attackers to breach web information.

Icarus can hijack any popular Drones mid-flight !!

Now a person can hijack nearly any drone mid-air just by using a tiny gadget.

Mr. Jonathan Andersson, who is the manager and security researcher at Trend Micro’s TippingPoint DVLab division, demonstrated a small devise, which he has made, at the PacSec security conference in Tokyo, Japan on Wednesday last.

According to him, his device called Icarus can hijack any popular Drones mid-flight, allowing hackers to lock the owner out, and take complete control of the drones.

This tiny Icarus can also attack many radio-controlled devices like helicopters, cars, boats and other remote control gears that run over the most popular wireless transmission control protocol called DSMx. DSMx is a protocol used to facilitate communication between radio controllers and devices, including drones, helicopters, and cars etc.

Icarus works by taking effect of DSMx protocol which permits the hackers to take full control over targeted Drones that allows attackers to steer, accelerate, brake and even crash them.

What is the lacuna that permits the hackers? Andersson explained that the DSMx protocol does not encrypt the ‘secret’ key that pairs a controller and hobbyist device, which facilitate an attacker to extract this secret by launching several brute-force attacks.  So, once the drone hijacker (Icarus) grabs the secret key, an attacker can send malicious commands to restrict the original owner of the drone from sending legitimate control commands, and instead, the drone will accept commands from the attacker.

Despite providing some patches and updated hardware, manufacturers have not been fully equipped with to provide a robust solution against such threats.

Chinese hackers won prize money of $215,000 !!

In the contest run by Trend Micro's Zero Day Initiative, Tokyo, Japan, for hacking Mobile Pwn2Own, Tencent Keen Security Lab Team from China has won a total prize money of $215,000. 

High security measures were put into effect to devices for both Google's Nexus 6P phones and Apple's iPhone 6S, but still they fell victim to the Chinese hackers.

Google's Nexus 6P: For hacking the Nexus 6P, the Keen Lab Team used a combination of two vulnerabilities and other weaknesses in Android and managed to install a rogue application on the Google Nexus 6P phone without user interaction.

Apple's iPhone 6S: The hackers took advantage of two iOS vulnerabilities -  a use-after-free bug in the renderer and a memory corruption flaw in the sandbox – and stole pictures from the device.  Even though Apple has implemented iOS update, hackers could break the securities successfully.  They have recently credited to have found a threat of remote code execution error.  They have also informed that an update of iOS 10.1 can also be hacked effortlessly.

Average cost of 'one' breached PHI data hard-drive !!

In the recent past, hackers used common devices such as webcams, baby monitors, video recorders etc. infected with software known as Mirai to attack websites of giant institutions like Twitter, Paypal, Netflix etc.  Even the websites with massive infrastructure powered by Dyn could not escape threat of DDoS to its Domain Name System. Users could not reach to many websites, including CNN, Wall Street Journal, Amazon.com etc. TOI reported on 23rd October.

Can anyone guess the impact of breached data on monetary terms, i.e. the average cost of ONE breached PHI (Protected Health Information) hard drive?

Although the cost of breached data cannot be estimated, an article on the basis of Ponemon study, sponsored by IBM, cost of one breached record is to the tune of 220 USD.  There are about 29000 records in a hard disk. The cost – 7 million Dollar!

EMC Global Data Protection Index shows that the average cost of INDUSTRY DATA LOSS in 2015 was to the tune of 9,14,000 Dollar for 2.36 Terabytes.

According to financial filings (March 3, 2016, HIPAA Journal), it is reported that Excellus BlueCross BlueShield data breach has reached to the tune of 17.3 million Dollar.

Cyber Security Review : 2016

Cybersecurity incites a level of fear that seems appropriate, given all that's at stake. These are boom times for cyberthreats, cyberattacks and cybercrime. More and more sophisticated attacks are being lauched. Every minute, the world sees about half a million attack attempts. This doesn't mean striving for perfection, but rather, ensuring that the most critical assets and information be secured and maximum possible risks be remediated and bringing down the residual risks to minimal acceptable levels.

In this post, we shall run through the cyber security stats for the year 2016 to help you get an insight of the attack trends :

10% - of the compromises were due to Malicious File upload vulnerability whereas 7% were due to Malicious insiders.

23% - of the total compromises have been targeted towards organizations from the retail industry.

40% - increase in compromises affecting corporate and internal networks in 2015.

31% - of the attacks, the attackers were targetting the Card Track data.

29% - of the attacks, the attackers targetting Card data from E-commerce transactions.

47% - of the attacks through POS malware were observed in the North American region.

79% - of the attacks were self-detected by the Latin Americans. However, 59% of the customer's attacks were detected by Law enforcement and Regulatory bodies.

168 - days are required on an average to detect an intrusion and were contained in approximately 15 days.

28 - days were needed on an average to contain an external intrusion after detection.

The more the number of days an attacker is within the network, the more damange he would perform and more time would be taken to recover from the damage caused.

IOT Security : Trend Analysis

Here, we come up with a most interesting summary of a highly trending topic in Cyber Security - "IOT Security". All devices and networks connected to the Internet form the gamut of IOT. Gartner estimates a 43% increase in IoT devices coming online in 2016. Since, the idea of networking appliances and other objects is relatively new, security was not considered as part of the product design.

Let's take a look at the security issues trending in the IOT space observed in the span of last 6 months.

1) New protocols (Eg. NTP) are used for DDOS (Never knew Time would be used to perform a DDOS attack?)

2) China, Russia, Ukraine, Brazil, and India are the top 5 sources of origin who perform these DDOS attacks.


3) China leads telnet bruteforce scans hunting for IoT devices with default passwords configured.

4) China, followed by Russia, Romania, Brazil, and Vietnam are the most likely locations for Command and Control (C&C) servers.

5) Around 2,174,216 telnet bruteforce scans were observed in last 6 months sourcing from 5,43,819 IP addresses.

6) Telnet scans have increased 140% year over year from July 2015

7) 50% of Telnet attacks were generated from top 13 ASNs

8) Around  6,293,889 SSH bruteforce attacks were observed in last 6 months from 28,616 IP addresses.

9) 92 ASNs comprise 2.1+ million Telnet brute force scans of which four of them are China telecom which comprise of 57% of the total Telnet scan.

10) The top 24 attacking ASNs (contribute >1% individually) combine for a total of 67% of the total attacks.

11) IOT Botnets using more than 52,000 IP addresses were DDOSing from multiple sources port (like port 53, 20000-60000) to fixed common destination port tcp 80.

12) SYN flood on port 80 is also performed with around 2.3 Gbps traffic.

13) 70% of the attacks are not originating from a spoofed source IP address.

14) The attack strategy used is as follows :
    a) Scan for IOT devices which have telnet enabled.
    b) After successful authentication via a bruteforce attack, attacker tries to identify the host's architecture and download the appropriate pack from the CnC server.
    c) Attempts to kill other additional rootkits already present or malware present on the compromised host.
    d) Connects to CNC using commonly used IRC channel.

The blessing and curse of IoT devices is that they are stateless devices which gets reboot under stress. This means their ability to launch attacks is very limited, but once re-infected and they can be leveraged all over again. So the next question to ponder upon is - How many IOT devices have their management ports available online and configured with vendor default passwords ?

All credits to :- F5 LABS THREAT ANALYSIS REPORT

A botnet with IOT devices discovered !!

Soon after the public disclosure of the Shellshock bug, researchers had detected BASHLITE malware. This BASHLITE malware includes code from Shellshock exploit and it was used in the wild to run DDOS attacks. It had the ability to infect multiple Linux architectures, hence, attackers used it to target IoT devices.

Recently, researchers from Sucuri discovered a botnet composed of millions of CCTV devices used to launch DDoS attacks against websites. It was observed that the BASHLITE source code leaked in 2015 was used by malware developers to create their own variant.

This botnet includes :
95% - Digital Video Recorders (DVRs) or cameras
4%  - Routers
1%  - Linux servers

This helps to conclude that the composition of attacks through IoT devices has drastically increased compared to DDoS through compromised servers and home-based routers. A large percentage were found to be located in Taiwan, Brazil and Colombia. Bots were using white-labeled DVRs described as “H.264 DVRs” manufactured by Dahua Technology.

When you paid your ransom and lost your data too !!

According to a new study from Trend Micro, they observed that 1 out of 5 UK firms end up paying ransom and never get their data back too.

Some stats from the study in UK are :

20%   - companies reported ransom of £1000
24 hrs - deadline given to pay the ransom
26%   - believed that the data encrypted wasn't valuable.
33 hrs - spent on a average to fix the problem
37%   - companies worried about being fined if data were lost, so paid up ransom to get the data back or prevent disclosure.
44%  - UK firms have been infected with ransomware atleast once in last 2 years.
£540  - Average amount of rans
om requested
66%  - refused to pay and don't bargain too
60%  - companies were able to retrieve data from backup files
79     - new ransomware families found in 2016
300   - IT managers were polled for the study

Malware in Word files found..!! What should you do?

There would be hardly any person in this globe who doesn't use Microsoft Word. It is omnipresent. Students use for their academic activities whereas the corporates live in these Word files the whole day.

Cybercriminals have been using "Macros" within Excel, to push in malicious code into documents. It's one thing to ask people to download an unrecognized file such as .Raw or .exe in an email, its an another thing to embed malware within trusted MS word documents.

In a recent attack, it was observed that the hidden lines of Macro code can route the target's web traffic through a proxy server, which allows an attacker to intercept all the network traffic on the proxy. An attacker than steal all the usernames and passwords very easily.

In order for an attacker to trick a user to open such emails, he social engineers the victim and impersonates himself as someone else. Hence, the message seems to appear from a very close trustworthy entity or complete strangers asking you to check out the Word file.

Things to do :

1) Check for email sender's authenticity :
Cybercriminals use official logos and email addresses which make it appear very legitimate and assume that it came from the real company. However, do not be in a hurry to open such a file, do a quick search and contact the company first through other channels.

2) Don't blindly click on "yes" to permission requests :
When your computer detects these malware within tweaked files, it will often give a pop up asking for permission before executing it. If you see a "Yes" and "No" option, do not blindly click on "Yes". This may cause the malware to override all the security controls in place and run with elevated privileges. So, double check and if you sense doubt, click "No".

Last.fm Hacked !! 43 million passwords leaked.

Your account is not far away from being compromised if you love to listen to music and you had an account of last.fm

The data breach actually took place on March 2012. Last.fm even accepted about the incident 3 months after the hack and requested all its users to change their passwords.

The stolen data has been surfaced in public after 4 years and now it has been brought to notice that the leak was huge. It contained around 43,570,999 user records which includes usernames, hashed passwords, email ids, user registration date, etc.

Lat.fm stored its users’ passwords using MD5 hashing without salt. MD5 is known to be vulnerable to hash collision attacks, which means that two different text may generate same hash values at some point of time. Due to unsalted hash values, it just took around 2 hours to crack around 40 million passwords.

Here, are some stats of the passwords :

1) 255,319 people used the phrase 123456
2) 92,652 used 'password' as password
3) Almost 67,000 used 'lastfm'
4) Around 64,000 used 123456789
5) 46,000 used 'qwerty'
6) Almost 36,000 used 'abc123'

Rambler.ru in trouble !! 98 million plaintext passwords hacked

Russia's email provider and internet portal rambler.ru has become the latest victim of a cyber attack. The attack dated back to 2012, but the internal database of the customer's were leaked online recently. This data included usernames, email addresses, ICQ numbers, passwords and social account data. All the data was found to be stored in clear text in their database.

It is claimed that Rambler.ru is the most visited website in Russia and is one of the largest sites of the world. The most common passwords used by Rambler.ru users, includes "asdasd," "123456," "000000," "654321," "123321," or "123123." Rambler.ru is the latest victim to join the list of "Mega-Breaches" revealed in recent months, when hundreds of Millions of online credentials from years-old data breaches on popular services, including LinkedIn, MySpace, VK.com, Tumblr, and Dropbox, were exposed online.

Users are advised to change their passwords for Rambler.ru account as well as other online accounts immediately, especially those using the same passwords

How to stop WhatsApp sharing my data with Facebook ?

In an effort to improve targeted advertisements on the social network, Whatsapp now shares your mobile phone number with Facebook. WhatsApp will now pass on users' information onto its parent company, Facebook.

This was a major change announced by Whatsapp's official blog. However, WhatsApp claims the changes will make the experience better for its users. It clarified that users' encrypted messages will remain private and that Whatsapp won’t post, sell, share, or give your phone number to advertisers.
But despite these assurances, you might still not be comfortable in passing your mobile number to Facebook.


How to stop it ?

If you are an existing user as of August 25, 2016, Whatspp allows you to decide whether Facebook should send you targetted ads and products experiences.

1) Just Go To > Accounts > Share my account info - Remove the tick

2) Tap on Don't share..!!




If you choose to opt out, Facebook will no longer be able to suggest friends or improve the ads you see based on your WhatsApp number.

According to WhatsApp, this is also available within the app settings on Android for 30 days after you accept the new privacy policy and terms

FBI-owned Megaupload.com presents soft porn

The US Government had seized several domain names belonging to Kim dotcom's file hosting service. They had a case against Megaupload domain and it was brought down half a decade ago. However, the FBI authorities have not taken necessary steps to keep it secured and recently it was found that Megaupload.org links to a soft porn portal.

Over the span of 5 years, only little progress has been made legally. The US government controls most of the the company's assets which includes a dozen of other domains such as Megastuff.co, Megaclicks.org, Megaworld.mobi, Megaupload.com, Megaupload.org, and Megavideo.com.

Earlier over the years a banner was displayed conveying that the domain has been seized as part of criminal investigation. However, two days ago, all the domains including megaupload.org, megastuff.co, megaclicks.org and megaworld.mobi was nourished with a site dedicated to soft porn advertisements. It was surprising to find that the administrative and technical contact for all these domains were the internal team of FBI since they had seized it.

What made this happen ?

The FBI used an expired domain named Cirfu.net for their nameservers. After Cirfu.net expired, someone else bought that domain name and linked Megaupload.com to display ads of scams. However, the U.S. government authorities fixed this by taking down bthe nameservers altogether. But, some of the seized domains were left untouched.

Cirfu.net domain got expired once again few weeks ago when it was picked up by an outsider and parked it at Rook Media, to rake in some cash from the FBI-controlled domains.

The WHOIS data clearly indicates that Megaupload.org still uses the old Cirfu.net nameservers, which means that an outsider is now able to control several of the 'hijacked' Megaupload domain names.

No much visitors have been observed on the ‘hijacked’ domains but it is embarrassing to have them linked to ads and soft porn. Kim Dotcom reacts to this incident stating - “Their handling of the Megaupload domain is a reflection of the entire case: Unprofessional,”

Corporate espionage with iOS Zero-day vulnerabilities

Recently, a very sophisticated and targeted mobile attack on iOS using three zero-day vulnerabilities was discovered. The attacker can exploit 3 zero-day vulnerabilities (CVE-2016-4655, CVE-2016-4656, CVE-2016-4657) to silently jailbreak an iOS device and stealthily spy on victims, collecting information from apps including Gmail, Facebook, Skype, WhatsApp, Calendar, etc. Organizations who have their employees use their phones for both personal and professional communications are susceptible to such attacks.

NSO Group, an organization that claims to specialize in “cyber war,” created Pegasus, a mobile espionage product which uses three previously-unknown vulnerabilities in iOS. It takes advantage of : always connected (Wi-Fi, 3G/4G), voice communications, camera, email, messaging, GPS, passwords, and contact lists. 

STAGE 1 Delivery and WebKit vulnerability: The attacker tricks a user to visit a malicious HTML page / file from his iPhone, that exploits a vulnerability (CVE-2016-4655) in WebKit (used in Safari and other browsers). 

STAGE 2 Jailbreak: On successful exploitation of Safari browser, it downloads an obfuscated and encrypted package. Each time the package is downloaded, it is encrypted with unique keys, making traditional network-based controls ineffective. It contains the code that is needed to exploit the iOS Kernel (CVE-2016-4656 and CVE-2016-4657) and a loader that downloads and decrypts a package for stage 3. 

STAGE 3 Espionage software: Post remote jailbrake, the espionage software, daemons, and other processes that are used are downloaded and hooks into the applications the attacker wishes to spy on. Additionally, stage 3 detects if the device was previously jailbroken through another method and, if so, removes any access to the device that the jailbreak provides, such as via SSH. The software also contains a failsafe to remove itself if certain conditions are present.

The target’s phone is remotely jailbroken and  all personal information including Call lists, texts, calendar and contacts are all copied and sent to the attacker.  It activates the phone’s cameras and microphone to snoop on conversations around the device. Victim’s movements are tracked and even messages from end-to-end encrypted chat clients are stolen. Competitors and nation-state actors are more interested in credentials and communications and business apps such as Gmail, Skype, WhatsApp, Calendar and others that may contain confidential technical, financial, or customer information.

In this mobile era, ideally an attacker would have access to more sensitive information than from a compromised laptop. Researchers from Lookout and Citizen Lab assisted Apple to fix the vulnerabilities and Apple has successfully patched all the 3 vulnerabilities in its 9.3.5 update. Hence, All iOS users should update to this version immediately.

More detailed technical analysis is available here.