Privacy Ninja



        • Secure your network against various threat points. VA starts at only S$1,000, while VAPT starts at S$4,000. With Price Beat Guarantee!

        • API Penetration Testing
        • Enhance your digital security posture with our approach that identifies and addresses vulnerabilities within your API framework, ensuring robust protection against cyber threats targeting your digital interfaces.

        • On-Prem & Cloud Network Penetration Testing
        • Boost your network’s resilience with our assessment that uncovers security gaps, so you can strengthen your defences against sophisticated cyber threats targeting your network

        • Web Penetration Testing
        • Fortify your web presence with our specialised web app penetration testing service, designed to uncover and address vulnerabilities, ensuring your website stands resilient against online threats

        • Mobile Penetration Testing
        • Strengthen your mobile ecosystem’s resilience with our in-depth penetration testing service. From applications to underlying systems, we meticulously probe for vulnerabilities

        • Cyber Hygiene Training
        • Empower your team with essential cybersecurity knowledge, covering the latest vulnerabilities, best practices, and proactive defence strategies

        • Thick Client Penetration Testing
        • Elevate your application’s security with our thorough thick client penetration testing service. From standalone desktop applications to complex client-server systems, we meticulously probe for vulnerabilities to fortify your software against potential cyber threats.

        • Source Code Review
        • Ensure the integrity and security of your codebase with our comprehensive service, meticulously analysing code quality, identifying vulnerabilities, and optimising performance for various types of applications, scripts, plugins, and more

        • Email Spoofing Prevention
        • Check if your organisation’s email is vulnerable to hackers and put a stop to it. Receive your free test today!

        • Email Phishing Excercise
        • Strengthen your defense against email threats via simulated attacks that test and educate your team on spotting malicious emails, reducing breach risks and boosting security.

        • Cyber Essentials Bundle
        • Equip your organisation with essential cyber protection through our packages, featuring quarterly breached accounts monitoring, email phishing campaigns, cyber hygiene training, and more. LAUNCHING SOON.

Hacking Group Used 11 Zero-Days To Attack Windows, iOS, Android Users

Hacking Group Used 11 Zero-Days To Attack Windows, iOS, Android Users

Project Zero, Google’s zero-day bug-hunting team, discovered a group of hackers that used 11 zero-days in attacks targeting Windows, iOS, and Android users within a single year.

The Project Zero team revealed that the hacking group behind these attacks ran two separate campaigns, in February and October 2020.

This month’s report showcases the use of seven zero-days after a previous one published in January showed how four zero-days were used together with n-day exploits to hack potential targets.

Just as before, the attackers used a couple of dozen websites hosting two exploit servers, each of them targeting iOS and Windows or Android users.

“In our testing, both of the exploit servers existed on all of the discovered domains,” Project Zero team member Maddie Stone said.

“After initial fingerprinting (appearing to be based on the origin of the IP address and the user-agent), an iframe was injected into the website pointing to one of the two exploit servers.”

Also Read: Data Protection Officer Singapore | 10 FAQs

Attack flow (Project Zero)

All in all, while analyzing the October 2020 campaign, the Project Zero researchers found:

  • one full exploit chain targeting fully patched Windows 10 using Google Chrome
  • two partial chains targeting 2 different fully patched Android devices running Android 10 using Google Chrome and Samsung Browser
  • several RCE exploits for iOS 11-13 and a privilege escalation exploit for iOS 13 (with the exploited bugs present up to iOS 14.1)

“When combined with their earlier 2020 operation, the actor used at least 11 0-days in less than a year,” Stone added.

The 11 zero-days used to build the exploit chains during last year attacks include:

  • CVE-2020-6418 – Chrome Vulnerability in TurboFan (February 2020)
  • CVE-2020-0938 – Font Vulnerability on Windows (February 2020)
  • CVE-2020-1020 – Font Vulnerability on Windows (February 2020)
  • CVE-2020-1027 – Windows CSRSS Vulnerability (February 2020)
  • CVE-2020-15999 – Chrome Freetype heap buffer overflow (October 2020)
  • CVE-2020-17087 – Windows heap buffer overflow in cng.sys (October 2020)
  • CVE-2020-16009 – Chrome type confusion in TurboFan map deprecation (October 2020)
  • CVE-2020-16010 – Chrome for Android heap buffer overflow (October 2020)
  • CVE-2020-27930 – Safari arbitrary stack read/write via Type 1 fonts (October 2020)
  • CVE-2020-27950 – iOS XNU kernel memory disclosure in mach message trailers (October 2020)
  • CVE-2020-27932 – iOS kernel type confusion with turnstiles (October 2020)

Each of the discovered exploits revealed an expert understanding of the vulnerability being exploited and exploit development.

Additionally, in the case of the Chrome Freetype zero-day, the exploitation method used by this hacking group was new to Project Zero.

“Exploitation aside, the modularity of payloads, interchangeable exploitation chains, logging, targeting, and maturity of this actor’s operation set these apart,” Project Zero added.

Also Read: Practitioner Certificate In Personal Data Protection: Everything You Need To Know

“The process to figure out how to trigger the iOS kernel privilege vulnerability would have been non-trivial. The obfuscation methods were varied and time-consuming to figure out.”



Subscribe to our mailing list to get free tips on Data Protection and Data Privacy updates weekly!

Personal Data Protection


We have assisted numerous companies to prepare proper and accurate reports to PDPC to minimise financial penalties.


Click one of our contacts below to chat on WhatsApp

× Chat with us