Normally Apple wants only good news around a product launch, after all what is the point of spending a fortune on a new iPhone knowing that all your data is going to a government that might cut your head off if it does not like what it reads? The problem might exist but fixing it can probably wait a few days, but this issue was one it could not ignore as a Saudi activist found himself being snooped on.
Security researchers determined that Israel-based NSO Group used a “feature” in Apple’s messaging software to “exploit and infect” the latest devices with spyware.
The bug, disclosed yesterday by Citizen Lab, allowed a hacker using NSO’s Pegasus malware to gain access to a device owned by an unnamed Saudi activist, according to security researchers. Apple said the flaw could be exploited if a user on a vulnerable device received a “maliciously crafted” PDF file.
The flaw was a “zero-day” vulnerability, a term that refers to recently discovered bugs that hackers can exploit and haven’t yet been patched. Victims didn’t have to click on the malicious file for it to infect their devices, something known as a “zero-click” exploit, according to a report released by Citizen Lab, a cyber-research unit of the University of Toronto.
John Scott-Railton, senior researcher at Citizen Lab, said in a text message that messaging apps are the soft underbelly of security.
“They are ubiquitous, which makes them really attractive, so they are an increasingly common target for attackers. They need to be a major priority for security”, he added. “Narrowing the attack surface from chat apps will go a long way toward making all of our devices more secure.”
Apple is patching the bug on the iPhone, iPad, Mac and Apple Watch via iOS 14.8, iPadOS 14.8, macOS 11.6 and watchOS 7.6.2 software updates. The software releases came the day before a highly anticipated Apple product launch event on Tuesday. The company is expected to announce the release date for iOS 15, Apple’s next major software update, which will contain additional security protections.
“After identifying the vulnerability used by this exploit for iMessage, Apple rapidly developed and deployed a fix in iOS 14.8 to protect our users”, Ivan Krstić, head of security engineering and architecture at Apple, said in a statement.
“We’d like to commend Citizen Lab for successfully completing the very difficult work of obtaining a sample of this exploit so we could develop this fix quickly.”
Krstić added that attacks like this one are “highly sophisticated, cost millions of dollars to develop, often have a short shelf life and are used to target specific individuals”.
“While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data,” he said.
NSO Group has insisted that the spyware is intended to be used to fight terrorism and crime, not to aid in human rights abuses.
In its own statement, NSO Group said the company “will continue to provide intelligence and law enforcement agencies around the world with life saving technologies”.
In June, the company published its first “Transparency and Responsibility Report,” which defended its technology and efforts to curb misuse by customers.