Days after heated controversy around the globe over Pegasus spyware allegedly tapping phones of human rights activists, journalists and even heads of state, Apple has detected a new zero-day, zero-click exploit called ‘FORCEDENTRY’ in Apple’s iMessage service, allegedly used by Israel’s NSO Group to install Pegasus spyware in devices including the iPhone, iPad, MacBook and Apple Watch.
A team of researchers at Toronto-based Citizen Lab, who have been investigating Pegasus Spyware, found the problem while analysing a Saudi activist’s phone that had been compromised with the code.
According to media reports, the cybersecurity watchdog organisation in Canada released a software update for a weakness that can let spyware infect devices without users even clicking on a malicious message or link. The researchers have advised updating the operating systems on their Apple devices in order to avoid their smartphones and laptops getting affected till the update rolled out by Apple on Monday is installed. Citizen Lab wrote in a post:
“We determined that the mercenary spyware company NSO Group used the vulnerability to remotely exploit and infect the latest Apple devices with the Pegasus spyware.”
Hours after releasing the fix, Apple said it had “rapidly” developed the update following Citizen Lab’s discovery of the problem. The company also noted:
“Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals.”
Citizen Lab researcher John Scott-Railton in a series of tweets explained how the Citizen Lab discovered the exploit.Marczak said:
“We believe that the FORCED ENTRY exploit has been in use by NSO Group since at least February 2021. According to Apple’s analysis, the exploit works against all iOS, macOS, and WatchOS versions prior to those released September 13, 2021.”
4/ NSO Group says that their spyware is only for targeting criminals & terrorists.
But here we are… again: their exploits got discovered by us because they were used against an activist.
Thesis: discovery is inevitable byproduct of selling spyware to reckless despots. pic.twitter.com/fsnmSZF6ny
— John Scott-Railton (@jsrailton) September 13, 2021
Israeli firm NSO Group has been under fire across the globe since an international media investigation claimed it was used to spy on the phones of human rights activists, journalists and even heads of state.
