The attack of the iPhone could also have targeted Android and Windows – Naked Security

It has been reported that the major hacking of iPhones last week was also targeting Android smartphones and Windows computers.

In its announcement, Google hinted at nation-state participation, but a separate report that the Windows and Android devices were also on the target list offered a new twist to the story.

If this is correct, the inclusion of Windows and Android should not be surprising – it makes sense to target specific groups of people via a small group of websites in order to target as many computer devices as possible in order to do not miss anyone.

Of course, none of this can currently be verified. For the moment, these are just anonymous sources that speak to a few journalists and offer information that may never be confirmed.

In fact, the fact that this is taken seriously is partly because the companies involved – Google, Microsoft, Apple – do not seem willing to deny it.

Deeper meaning

However, another way to understand this story is to point out that the who and Why is less important than the How.

The original Google report mentions that involuntary victims have also been caught in the attacks, implying that everyone could be a victim of a future campaign.

Victims would have been infected with spyware by persuading them to open a malicious link – a generic but effective tactic.

The infected domains would have been indexed by Google Search (quite normal if the domain is not known to be malicious), which prompted the FBI to ask the company to remove them from the list.

The first problem concerns collateral and infected victims.

The campaign was discovered in early 2019 and the iPhone vulnerabilities involved have since been corrected and Apple's patch deployment process is well-established. However, if Android or Windows devices were involved, the patch timeline becomes less certain because updates can be optional and slow to appear.