Apple pushes back against Google on iOS hack targeting Muslims

Apple vulnerabilities are rare and often worth millions, so it was a revelation when Google disclosed a string of security flaws that allowed for the hacking of any iPhones used to visit certain websites laced with malware. Now Apple is responding to those attacks, offering more details on the scope of the security issues, in a post on Friday.  

On Aug. 30, Google's Project Zero security researchers revealed that they'd found multiple websites with malware that could hack people's iPhones. The malware had the ability to gain full control, stealing photos, messages and location data, and was installed when an iPhone user visited a certain page. The malware was also able to install more malicious apps, as well as harvest passwords and encrypted messages, according to the security researchers. 

Google didn't disclose what websites the malware was hidden on, but Apple provided more details on Friday. 

"First, the sophisticated attack was narrowly focused, not a broad-based exploit of iPhones 'en masse' as described. The attack affected fewer than a dozen websites that focus on content related to the Uighur community," Apple said in a statement.

The Chinese government has made forceful efforts against its Uighur Muslim population, detaining more than 1 million people in its Xinjiang region. Technology has played a key role in these human rights abuses, including the use of facial recognition to track the population. The Chinese government had also reportedly been forcing visitors at Xinjiang's borders to download malware on devices to scan for files related to Islamic content. On Thursday, Reuters reported that a hacking campaign compromising several telecom companies was also targeting Uighur Muslims.  

Security company Volexity detailed a hacking campaign targeting Uighur Muslims in China on Monday, finding at least 11 websites compromised to infect Android devices and collect similar data. Those websites included pages related to Uighur news and press in Turkey. 

Google said it would continue working with Apple to keep people safe online.

"Project Zero posts technical research that is designed to advance the understanding of security vulnerabilities, which leads to better defensive strategies. We stand by our in-depth research which was written to focus on the technical aspects of these vulnerabilities," a Google spokesperson said in a statement.

Volexity noted that the attacks had "possible ties" to the security flaws disclosed by Google last week. After the disclosure, sources told TechCrunch that China was potentially behind the attacks targeting Uighur Muslims. 

Apple didn't specifically point to China as being behind these attacks but noted that it was targeting the Uighur population. It also denied that the attacks had been going on for two years and said that the website attacks were active for only two months. 

"We fixed the vulnerabilities in question in February -- working extremely quickly to resolve the issue just 10 days after we learned about it. When Google approached us, we were already in the process of fixing the exploited bugs," Apple said in its statement.

China's embassy didn't immediately respond to a request for comment.

Originally published Sept. 6, 10:35 a.m. PT.
Update, 11:46 a.m. PT: Adds response from Google.