Apple fixes security flaw that apparently affected iPhone, Macs, and Apple watches

Apple has released a critical software patch to fix a security vulnerability that researchers say could allow hackers to directly infect iPhones and other Apple devices without any user action.

Researchers at the University of Toronto’s Citizen Lab said the security issue was exploited to install spyware on a Saudi activist’s iPhone. They said they had great confidence that the world’s most infamous hacker company, the Israeli group NSO, was behind the attack.

The previously unknown vulnerability affected all major Apple devices – iPhones, Macs, and Apple Watches, the researchers said. NSO Group responded with a one-sentence statement saying it would continue to provide tools to fight “terrorism and crime”.

It was the first time that a so-called “zero click” exploit – an exploit that does not force users to click on suspicious links or open infected files – has been detected and analyzed, the researchers said. They found the malicious code on September 7 and immediately alerted Apple. The targeted activist requested to remain anonymous, they said.

“We do not necessarily attribute this attack to the Saudi government,” said researcher Bill Marczak.

Citizen Lab had previously found evidence of zero-click exploits used to hack the phones of al-Jazeera reporters and other targets, but had yet to see the malicious code itself.

Although security experts say the average iPhone, iPad, and Mac user usually doesn’t have to worry – such attacks tend to be limited to specific targets – the discovery has always been alarming. security professionals.

Malicious image files were transmitted to the activist’s phone through the iMessage instant messaging app before being hacked with NSO’s Pegasus spyware, which opens a phone eavesdropping and stealing data to distance, Marczak said. It was discovered during a second examination of the phone, which forensics showed had been infected in March. He said the malicious file causes devices to crash.

Citizen Lab says the case reveals, once again, that NSO Group allows its spyware to be used against ordinary civilians.

In a blog post, Apple said it was releasing a security update for iPhones and iPads because a “maliciously crafted” PDF file could cause them to be hacked. He said he was aware the issue may have been exploited and cited Citizen Lab.

In a subsequent statement, Apple Chief Security Officer Ivan Krstić praised Citizen Lab and said such exploits “do not pose a threat to the overwhelming majority of our users.” He noted, as he has done in the past, that such feats typically cost millions of dollars to develop and often have a short lifespan. Apple did not answer questions about whether this was the first time it had patched a zero-click vulnerability.

Users should receive alerts on their iPhone prompting them to update the phone’s iOS software. Those who want to take the plunge can go to the phone settings, click on “General” then “Software update” and directly trigger the patch update.

Citizen Lab called the iMessage FORCEDENTRY exploit and said it was effective against Apple iOS, macOS, and WatchOS devices. He urged people to immediately install security updates.

Researcher John Scott-Railton said the news highlights the importance of securing popular messaging apps against such attacks. “Chat apps are increasingly becoming an important way for nation states and hackers to access phones,” he said. “And that is why it is so important that businesses strive to make sure that they are as locked down as possible.”

The researchers said it also undermines NSO Group’s claims that it only sells its spyware to law enforcement officials for use against criminals and terrorists and checks its customers to ensure that there is no abuse.

“If Pegasus had only been used against criminals and terrorists, we would never have found this stuff,” Marczak said.

Facebook’s WhatsApp was also reportedly targeted by a clickless exploit from NSO. In October 2019, Facebook sued NSO in US federal court for allegedly targeting some 1,400 users of the encrypted email service with spyware.

In July, a global media consortium released a damning report on how NSO Group clients have spied on journalists, human rights activists, political dissidents and people close to them for years, the group of hackers directly involved in targeting. Amnesty International said it had confirmed 37 successful Pegasus infections on the basis of a disclosed targeting list, the origin of which was not disclosed.

One case involved the fiancee of Washington Post journalist Jamal Khashoggi just four days after her assassination at the Saudi consulate in Istanbul in 2018. The CIA blamed the murder on the Saudi government.

The recent revelations have also prompted calls for an investigation into whether Hungary’s right-wing government used Pegasus to covertly monitor critical journalists, lawyers and businessmen. India’s parliament also erupted into protests as opposition lawmakers accused Prime Minister Narendra Modi’s government of using NSO Groups proceeds to spy on political opponents and others.

France is also trying to shed light on allegations that President Emmanuel Macron and members of his government may have been targeted in 2019 by an unidentified Moroccan security service using Pegasus. Morocco, a key ally of France, has denied this information and is taking legal action to counter allegations involving the North African kingdom in the spyware scandal.