Citizen Lab researchers on Thursday It has been published According to their study, spyware linked to the Israeli company NSO was installed on many victims’ devices through a previously unknown vulnerability in the iOS system. Among other things, the group scanned the devices of members of a civil society organization in Washington, where it discovered signs that cell phones may have been infected with NSO’s Pegasus spyware.
Security experts did not provide further details about those affected and other possible observations, but the vulnerability certainly deserves attention. This flaw made it possible for iPhones running iOS version 16.6 to be compromised without any interaction from the victim, so it was suitable for zero-click exploits – where malicious code can be delivered to mobile phones practically without opening any infectious attachments or links.
After reporting the bug, Apple found a second vulnerability and then released the necessary security fixes with version 16.6.1, which does not bring new features, but only patches the said vulnerabilities.
The renaissance of the security professions was not achieved through the European Union, but through pain
This is NIS2, the European Union’s cybersecurity directive. In a recent Kraftie podcast, we talked about whether the security profession will become more valuable as a result.
Last year, Apple announced a development called Lockdown Mode, through which it wants to strengthen the protection of politicians, activists and other public figures against Pegasus-like spyware and state-sponsored hacker attacks. Private Lock Mode disables many functions and device access in order to leave as few vulnerable spots as possible for attackers: for example, iMessage preview modes, built-in JavaScript functionality in the Safari browser, blocks most attachments in the Messages app, and blocks from unknown people , phone numbers for incoming FaceTime calls, invitations to Apple services, and removing shared albums from the Photos app.
The development was preceded by the fact that the Cupertino company received more and more calls from the government after the Pegasus scandal broke out in 2021. As the company notes: The majority of users will never be the target of state-sponsored attacks, as a narrower group is considered vulnerable, including journalists and human rights activists. And business leaders and politicians. The main reason for this is that spyware like Pegasus can cost hundreds of millions of dollars and is only suitable for targeting a narrower circle. Pegasus was requested primarily for law enforcement and counter-terrorism purposes by the professional services of nation states, under strict licensing conditions, a package that supports reconnaissance and investigative activities, and which has led to misuse on several occasions in recent years.
Big tech companies don’t take kindly to the Israeli company’s activities: Apple filed a lawsuit in 2021 because, according to NSO Group, it hurt its business when it was revealed that one of the iOS vulnerabilities had been used by a number of people. From violations, and due to attempts to attack WhatsApp, Meta took legal action. That year, the US Department of Commerce also blacklisted the group, thus preventing cooperation with US companies, the most significant action the US government can take against a foreign company. In addition to NSO Group, Candiru and Cytrox, which also make spy tools for government use, are rolling out more and more advanced services, which has also drawn reactions from technology companies.
Apple issued updates to disable spyware in September last year, a month and a half after the Pegasus scandal, after the University of Toronto was able to identify the exploited vulnerability. Mapping similar attack surfaces and then developing software based on them is extremely detailed and lengthy work, consuming millions of dollars, and completed solutions are usually short-lived, Ivan Krstić, the company’s security engineer, said at the time. As you can see, even today there are gaps that have not been noticed.
