id	author	title	date	pages	extension	mime	words	sentences	flesch	summary	cache	txt
arstechnica-com-1589		iOS zero-day let SolarWinds hackers compromise fully updated iPhones | Ars Technica			.html	text/html	1234	95	64	iOS zero-day let SolarWinds hackers compromise fully updated iPhones | Ars Technica The Russian state hackers who orchestrated the SolarWinds supply chain attack last year exploited an iOS zero-day as part of a separate malicious email campaign aimed at stealing Web authentication credentials from Western European governments, according to Google and Microsoft. The campaign closely tracks to one Microsoft disclosed in May. In that instance, Microsoft said that Nobelium—the name the company uses to identify the hackers behind the SolarWinds supply chain attack—first managed to compromise an account belonging to USAID, a US government agency that administers civilian foreign aid and development assistance. If the targeted device was an iPhone or iPad, a server used an exploit for CVE-2021-1879, which allowed hackers to deliver a universal cross-site scripting attack. This exploit would turn off Same-Origin-Policy protections in order to collect authentication cookies from several popular websites, including Google, Microsoft, LinkedIn, Facebook, and Yahoo and send them via WebSocket to an attacker-controlled IP.	./cache/arstechnica-com-1589.html	./txt/arstechnica-com-1589.txt