Light

Episode #929 Quiz

Operation Triangle
Date: 2023-06-27 | Length: 1.75 hrs | Episode page at twit.tv

About this episode

Kaspersky’s Operation Triangulation showed a four-year, zero-click iMessage spyware chain: a malicious attachment triggered code execution, downloaded privilege-escalation exploits, then a root implant named TriangleDB. It communicated over HTTPS with Protobuf, 3DES, and RSA, sent heartbeats, exfiltrated keychain, files, and geolocation, persisted only in memory, and self-uninstalled after 30 days.

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: According to the episode, what specific browser-rendering approach did DuckDuckGo say its new Windows browser uses for web page rendering?

Question 1

According to the episode, what specific browser-rendering approach did DuckDuckGo say its new Windows browser uses for web page rendering?

A custom Safari WebKit port with DuckDuckGo controls A Chromium fork with DuckDuckGo privacy patches Windows WebView2 using the Blink rendering engine A native Gecko engine with DuckDuckGo extensions

Question 2: What did Kaspersky identify as the initial, userless trigger for the iPhone spyware chain in Operation Triangulation?

Question 2

What did Kaspersky identify as the initial, userless trigger for the iPhone spyware chain in Operation Triangulation?

A Safari visit to a malicious webpage An iMessage attachment carrying an exploit A malicious profile installed through Settings A poisoned iCloud backup restored on reboot

Question 3: Which statement best matches the persistence behavior Kaspersky described for the TriangleDB implant?

Question 3

Which statement best matches the persistence behavior Kaspersky described for the TriangleDB implant?

It persists until the victim deletes the iMessage thread It installs as a launch daemon and survives device reboot It lives only in memory and disappears on reboot It stores itself in the user keychain for later recovery

Question 4: What did Kaspersky say was the mechanism behind the name 'Triangulation'?

Question 4

What did Kaspersky say was the mechanism behind the name 'Triangulation'?

Triangle-shaped domain names used for command-and-control A three-stage exploit chain against iMessage, kernel, and C2 Canvas fingerprinting that draws a yellow triangle in memory Geolocation triangulation from three network beacons

Question 5: Which set of communications artifacts did Kaspersky say can help identify an active Operation Triangulation infection?

Question 5

Which set of communications artifacts did Kaspersky say can help identify an active Operation Triangulation infection?

Only repeated TLS handshakes to a single hard-coded IP address iMessage domains, iCloud content domains, and C2 traffic with large outbound sessions Only local crash logs and kernel panic reports from the device Only DNS queries to Apple certificate revocation servers

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.