The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Apple fixed CVE-2023-38606 in iOS 16.6 and iPadOS 16.6, released July 24, 2023. The kernel flaw was one part of Operation Triangulation, a campaign Kaspersky described as beginning with a zero-click iMessage attack. Apple said it had received a report that the issue may have been actively exploited against iOS versions earlier than iOS 15.7.1.
What Apple patched
Apple’s iOS 16.6 security content described CVE-2023-38606 this way: “An app may be able to modify sensitive kernel state.” The fix used improved state management. Apple listed the update for iPhone 8 and later and the iPad families covered by its release notice.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Apple iPhone 14, 128GB, Midnight - Unlocked (Renewed) | $300.00 | Buy on Amazon |
| 2 |
|
Apple iPhone 16, 128GB, Pink - Unlocked (Renewed) | $574.99 | Buy on Amazon |
| 3 |
|
Apple iPhone 15, 128GB, Black - Unlocked (Renewed) | $409.00 | Buy on Amazon |
| 4 |
|
Apple iPhone 13, 128GB, Midnight - Unlocked (Renewed) | $262.00 | Buy on Amazon |
| 5 |
|
Apple iPhone 16e, 128GB, Black - Unlocked (Renewed) | $389.00 | Buy on Amazon |
Apple’s bulletin said it was aware of a report that the issue may have been actively exploited against versions of iOS released before iOS 15.7.1. That wording describes the reported exposure; it does not establish that every device running an earlier version was attacked. SecurityWeek reported that Apple also patched the issue across macOS and that the July 24, 2023 releases addressed at least 25 documented security bugs.
How CVE-2023-38606 fit into Operation Triangulation
Kaspersky described Operation Triangulation as a multi-stage attack. It began with a zero-click exploit delivered through iMessage, followed by privilege escalation. The attackers then used an undocumented Apple SoC hardware feature to bypass hardware-based memory protection and manipulate protected memory. Kaspersky identified CVE-2023-38606 as part of this chain.
#1 Best Overall
- This phone is unlocked and compatible with any carrier of choice on GSM and CDMA networks (e.g. AT&T, T-Mobile, Sprint, Verizon, US Cellular, Cricket, Metro, Tracfone, Mint Mobile, etc.).
- Please check with your carrier to verify compatibility.
- The device does not come with headphones or a SIM card. It does include a generic (Mfi certified) charging cable.
- Tested for battery health and guaranteed to have a minimum battery capacity of 80%.
The campaign’s named zero-days were CVE-2023-32434, CVE-2023-32435, CVE-2023-38606 and CVE-2023-41990. CVE-2023-38606 therefore was not the whole attack: it was one of several vulnerabilities identified in the campaign.
Kaspersky researcher Boris Larin said the flaw was difficult to discover because investigating it required understanding both hardware and software architectures in a closed ecosystem. The significance was not only that the bug affected the kernel, but that the attackers combined software exploits with an undocumented hardware capability.
Rank #2
- 6.1" Super Retina XDR OLED, HDR10, Dolby Vision, 1000nits (typ), 2000nits (HBM), 2556x1179px at 460ppi, 3561mAh Battery
- 128GB 8GB RAM, Apple A18 (3nm), Hexa-core (2x4.04 GHz + 4x2.20 GHz), Apple GPU 5-core, 16‑core Neural Engine
- Rear camera: 48MP, f/1.6, wide + 12MP, f/2.2, ultrawide, Front Camera: 12MP, f/1.9, wide, iOS 18, upgradable to iOS 18.5
- 4G LTE: 1/2/3/4/5/7/8/12/13/14/17/18/19/20/25/26/28/29/30/32/34/38/39/40/41/42/48/53/66/71, 5G: n1/2/3/5/7/8/12/14/20/25/26/28/29/30/38/40/41/48/53/66/70/71/75/76/77/78/79 - Dual eSIM
- Unlocked for freedom to choose your carrier. Compatible with both GSM & CDMA networks. The phone is unlocked to work with all GSM Carriers & CDMA Carriers Including AT&T, T-Mobile, Verizon, Sprint., Etc.
What the TriangleDB implant could do
Kaspersky’s June 21, 2023 analysis described TriangleDB as an implant that operated solely in memory. According to Kaspersky, restarting the device removed the implant’s traces. Without a restart, it automatically uninstalled after 30 days unless the attackers extended that period.
Kaspersky documented 24 commands. They could create, modify, exfiltrate and remove files; list and terminate processes; extract keychain items; and monitor geolocation. Kaspersky researcher Georgy Kucherin described the implant as a sophisticated tool with unusual characteristics.
Rank #3
- 6.1inch Super Retina XDR display. Aluminum with color-infused glass back. Ring/Silent switch
- Dynamic Island. A magical way to interact with iPhone. A16 Bionic chip with 5-core GPU
- Advanced dual-camera system. 48MP Main | Ultra Wide. Super-high-resolution photos (24MP and 48MP). Next-generation portraits with Focus and Depth Control. 4X optical zoom range
- Emergency SOS via satellite. Crash Detection. Roadside Assistance via satellite
- Up to 26 hours video playback. USB C, Supports USB 2. Face ID
What to do if you use an iPhone or iPad
Install available security updates
Keep iOS or iPadOS updated and install Apple security releases promptly. The July 2023 patch is historical; use the update offered for your device rather than treating iOS 16.6 as a current recommendation. Also keep applications and security software current, as Kaspersky advises.
Do not rely on a restart as a complete fix
A reboot could remove the in-memory implant Kaspersky described, but it would not close the vulnerability or prove that a device was safe. Kaspersky said a targeted device could be reinfected through another malicious iMessage attachment. Restarting is therefore not a substitute for applying security updates or investigating a suspected compromise.
Rank #4
- This pre-owned product is not Apple certified, but has been professionally inspected, tested and cleaned by Amazon-qualified suppliers.
- There will be no visible cosmetic imperfections when held at an arm’s length.
- This product is eligible for a replacement or refund within 90 days of receipt if you are not satisfied.
- Product may come in generic Box.
Understand what “zero-click” means here
Kaspersky characterized this campaign as using zero-click iMessage exploits. In this context, the initial attack did not require the recipient to tap a link or attachment. That does not mean every unsolicited message is an exploit or that every iPhone was affected; the cited finding concerns this specific campaign.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations should consider
For organizations managing Apple devices, Kaspersky recommends threat-intelligence access, endpoint detection and response, and incident-response and digital-forensics capabilities. These address different needs: intelligence can help teams understand relevant threats, endpoint tools provide detection telemetry, and response and forensics support investigation when compromise is suspected.
Best Value
- 6.1" Super Retina XDR OLED, HDR10, 800 nits (HBM), 1200 nits (peak), 2532x1170px at 460ppi, 4005mAh Battery
- 8GB RAM, Apple A18 6-core CPU (2 performance + 4 efficiency cores), Apple GPU 4-core, 16‑core Neural Engine
- Rear camera: 48MP, f/1.6, wide, Front Camera: 12MP, f/1.9, wide, iOS 18.3.1, upgradable to iOS 18.5
- Connectivity: Global 4G LTE, Sub-6 GHz 5G, LTE, Wi-Fi 6, Bluetooth 5.3, NFC, USB-C, Wireless Charging (7.5W). (does not have mmWave 5G or MagSafe or physical SIM card) - Dual eSIM Only
- Unlocked for freedom to choose your carrier. Compatible with both GSM & CDMA networks. The phone is unlocked to work with all GSM Carriers & CDMA Carriers Including AT&T, T-Mobile, Verizon, Straight Talk., Etc.
When assessing defensive coverage for a managed Apple fleet, compare how quickly updates can be deployed, what telemetry is available for in-memory or zero-click activity, the depth of threat intelligence, access to incident-response expertise, and compatibility with the organization’s device-management environment. No single control should be assumed to identify every exploit described in this campaign.
Can you check a device for TriangleDB?
Kaspersky announced a utility called triangle_check for searching for TriangleDB. The announcement establishes that the tool existed, but does not establish its current maintenance status or availability. Organizations considering it should verify those details with Kaspersky before relying on it. A clean result from a checker should not be treated as proof that a device was never compromised.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
