
Apple users should immediately update all their devices — iPhones, iPads, Macs and Apple Watches — to install an emergency patch for a zero-click zero-day exploited by NSO Group to install spyware.The security updates, pushed out by Apple on Monday, include iOS 14.8 for iPhones and iPads, as well as new updates for Apple Watch and macOS. The patches will fix at least one vulnerability that the tech behemoth said “may have been actively exploited.”Citizen Lab first discovered the never-before-seen, zero-click exploit, which it detected targeting iMessaging, last month. It’s allegedly been used to illegally spy on Bahraini activists with NSO Group’s Pegasus spyware, according to the cybersecurity watchdog.The digital researchers dubbed the new iMessaging exploit ForcedEntry.Citizen Group said in August that they had identified nine Bahraini activists whose iPhones were inflicted with Pegasus spyware between June 2020 and February 2021. Some of the activists’ phones suffered zero-click iMessage attacks that, besides ForcedEntry, also included the 2020 KISMET exploit.The activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini dissidents, and one member of Al Wefaq (a Shiite Bahraini political society), Citizen Lab wrote.The ForcedEntry exploit was particularly notable in that it was successfully deployed against the latest iOS versions — 14.4 & 14.6 — blowing past Apple’s new BlastDoor sandboxing feature to install spyware on the iPhones of the Bahraini activists.Citizen Lab first observed NSO Group deploying ForcedEntry in February 2021. Apple had just introduced BlastDoor, a structural improvement in iOS 14 meant to block message-based, zero-click exploits like these NSO Group-associated attacks — the month before. BlastDoor was supposed to prevent this type of Pegasus attack by acting as what Google Project Zero’s Samuel Groß called a “tightly sandboxed” service responsible for “almost all” of the parsing of untrusted data in iMessages.In a post on Monday, Citizen Lab researchers said that in March 2021, they had examined the phone of a Saudi activist who requested anonymity and determined that the phone had been infected with NSO Group’s Pegasus spyware. Last Tuesday, Sept. 7, Citizen Lab forwarded artifacts from two types of crashes on another phone that had been infected with Pegasus, suspecting that both infections showed parts of the ForcedEntry exploit chain.Citizen Lab forwarded the artifacts to Apple on Tuesday, Sept. 7. On Monday, Sept. 13, Apple confirmed that the files included a zero-day exploit against iOS and MacOS. Apple has designated the ForcedEntry exploit CVE-2021–30860: an as-yet-unrated flaw that Apple describes as “processing a maliciously crafted PDF may lead to arbitrary code execution.”Sniffing out NSO Group’s TracksCitizen Lab described several distinct elements that gives researchers high confidence that the exploit can be tied to the secretive Israeli spyware maker NSO Group, including a forensic artifact called CascadeFail.CascadeFail is a bug whereby “evidence is incompletely deleted from the phone’s DataUsage.sqlite file,” according to Citizen Lab. In CascadeFail, “an entry from the file’s ZPROCESS table is deleted, but not entries in the ZLIVEUSAGE table that refer to the deleted ZPROCESS entry,” they described.That has NSO Group’s fingerprints, they said: “We have only ever seen this type of incomplete deletion associated with NSO Group’s Pegasus spyware, and we believe that the bug is distinctive enough to point back to NSO.”Another telltale sign: multiple process names installed by the ForcedEntry exploit, including the name “setframed”. That process name was used in an attack with NSO Group’s Pegasus spyware on an Al Jazeera journalist in July 2020, according to Citizen Lab: a detail that the watchdog didn’t reveal at the time.Zero click remote exploits such as the novel method used by Pegasus spyware to invisibly infect an Apple device without the victim’s knowledge or the need for the victim to click on anything at all were used to infect one victim for as long as six months. They’re pure gold to governments, mercenaries and criminals who want to secretly surveil targets’ devices without being detected.Pegasus is a powerful spyware: it can turn on a target’s camera and microphone so as to record messages, texts, emails, and calls, even if they’re sent via encrypted messaging apps such as Signal.Pegasus’s Threadbare NarrativeNSO has long maintained that it only sells its spyware to a handful of intelligence communities within countries that have been thoroughly vetted for human rights violations. The company has repeatedly tried to keep up that narrative, taking the tactic of questioning Citizen Lab’s methods and motives.But, as pointed out by Hank Schless, Senior Manager of security solutions at endpoint-to-cloud security company Lookout, the narrative is now pretty threadbare. “The recent exposure of 50,000 phone numbers linked to targets of NSO Group customers was all people needed to see right through what NSO claims,” he told Threatpost on Monday.“Since Lookout and The Citizen Lab first discovered Pegasus back in 2016, it has continued to evolve and take on new capabilities,” he elaborated. “It can now be deployed as a zero-click exploit, which means that the target user doesn’t even have to tap a malicious link for the surveillanceware to be installed.While the malware has adjusted its delivery methods, the basic exploit chain remains the same, Schless continued. “Pegasus is delivered via a malicious link that’s been socially engineered to the target, the vulnerability is exploited and the device is compromised, then the malware communicated back to a command-and-control (C2) server that gives the attacker free reign over the device. Many apps will automatically create a preview or cache of links in order to improve the user experience. Pegasus takes advantage of this functionality to silently infect the device.”Schless said that this is an example of how important it is for both individuals and enterprise organizations to have visibility into the risks their mobile devices present, Pegasus being just onei “extreme, but easily understandable example.“There are countless pieces of malware out there that can easily exploit known device and software vulnerabilities to gain access to your most sensitive data,” he continued. “From an enterprise perspective, leaving mobile devices out of the greater security strategy can represent a major gap in the ability to protect the entire infrastructure from malicious actors. Once the attacker has control of a mobile device or even compromises the user’s credentials, they have free access to your entire infrastructure. Once they enter your cloud or on-prem apps, they can move laterally and identify sensitive assets to encrypt for a ransomware attack or exfiltrate to sell to the highest bidder.”Kevin Dunne, president at unified access orchestration provider Pathlock, noted that the Pegasus infections point to the need for businesses to look beyond securing servers and workstations as primary targets for cyberattacks and espionage. “Mobile devices are now used broadly and contain sensitive information that needs to be protected,” he explained.To protect themselves against spyware, businesses should look at their mobile device security strategy, Dunne said — particularly when threats come in forms that are far more insidious than suspicious SMS messages or phishy links that security teams can train users to avoid.“Spyware attackers have now engineered zero click attacks which are able to get full access to a phone’s data and microphone/camera by using vulnerabilities in third party apps or even built-in applications,” Dunne said. “Organizations need to make sure they have control over what applications users download on to their phones, and can ensure they are up to date so any vulnerabilities are patched.”Originally published at https://threatpost.com
Everything is very open with a clear description of the issues. It was really informative. Your website is very helpful. Thank you for sharing!
Good day! I just wish to give you a huge thumbs up for your excellent information you have got here on this post. I am coming back to your blog for more soon. Good day! I just wish to give you a huge thumbs up for your excellent information you have got here on this post. I am coming back to your blog for more soon. נערות ליווי בחולון
Hi there! I just want to offer you a huge thumbs up for your great info youve got here on this post. I am coming back to your website for more soon.
Mature gurup anal, Gurup anal, Iri memeli mature,
Büyük memeli olgun 14:14 Koca memeli anneler, Büyük memeli amcıklar, Alman olgun,
Alman eski, Annem annem, Annem.
I’ve been absent for some time, but now I remember why I used to love this website. Thanks , I will try and check back more frequently. How frequently you update your web site?
17 yaşındayım 160 boyundayım ve 68 yaz kesin kilo vermek istiyorum
artık ne gerekirse onu yapıcam.özellikle göbek bilgesinde
kalça ve Forum. Yeni Mesajlar. Kadın Haberleri.
Kadın Gündemi. Trend Konular Yeni Mesajlar Son Aktiviteler.
Ürün İncelemeleri. Latest content Latest updates.
With every thing which appears to be developing inside this subject material, your opinions are somewhat radical. On the other hand, I beg your pardon, but I do not give credence to your entire idea, all be it exhilarating none the less. It would seem to everyone that your commentary are generally not totally rationalized and in reality you are your self not totally confident of your assertion. In any event I did appreciate looking at it.
Thanks a lot for sharing this with all folks you really understand what you’re speaking about! Bookmarked. Please also seek advice from my site =). We may have a hyperlink trade contract between us!
I beloved as much as you’ll receive carried out right here. The sketch is tasteful, your authored subject matter stylish. however, you command get got an impatience over that you want be handing over the following. ill no doubt come more previously again since exactly the same nearly very ceaselessly inside case you defend this hike.
you’re really a good webmaster. The site loading speed is incredible. It seems that you are doing any unique trick. In addition, The contents are masterpiece. you have done a great job on this topic!
Fantastic website you have here but I was curious about if you knew of any community forums that cover the same topics discussed in this article? I’d really love to be a part of online community where I can get feed-back from other knowledgeable individuals that share the same interest. If you have any recommendations, please let me know. Bless you!
Hi, I think your site might be having browser compatibility issues. When I look at your website in Safari, it looks fine but when opening in Internet Explorer, it has some overlapping. I just wanted to give you a quick heads up! Other then that, fantastic blog!
I got what you mean , thanks for posting.Woh I am delighted to find this website through google. “Since the Exodus, freedom has always spoken with a Hebrew accent.” by Heinrich Heine.
My brother suggested I might like this website. He was totally right. This submit actually made my day. You cann’t consider simply how a lot time I had spent for this information! Thank you!
This is a topic which is close to my heart… Best
wishes! Where are your contact details though?
cbd affiliate marketing for supplements
work from home jobs for beginners in the usa
beginner’s pharmacy affiliate marketing guide
residual income
make money blogging from home
highest paying herbal supplement affiliate
programs
work from home
work from home jobs for beginners with disabilities
easy work from home jobs for beginners
passive income streams
pharmacy affiliate marketing case studies for beginners
affiliate marketing for fitness bloggers
I need some diabetes medicine, but I don’t have a prescription and I
don’t want to leave my house Glipizide for sale, no prescription needed
Online pharmacy for diabetes meds in the USA, no
prescription needed Online drugstore for Glipizide without prescription
It’s hard to find knowledgeable people on this topic, but you sound like you know what you’re talking about! Thanks
Of course, what a great blog and enlightening posts, I surely will bookmark your website.Have an awsome day!
I was curious if you ever thought of changing the structure of your site? Its very well written; I love what youve got to say. But maybe you could a little more in the way of content so people could connect with it better. Youve got an awful lot of text for only having one or 2 images. Maybe you could space it out better?
Some times its a pain in the ass to read what people wrote but this site is rattling user genial! .
Appreciating the persistence you put into your website and detailed information you present. It’s great to come across a blog every once in a while that isn’t the same out of date rehashed material. Great read! I’ve bookmarked your site and I’m including your RSS feeds to my Google account.
I got what you intend, appreciate it for posting.Woh I am thankful to find this website through google. “I was walking down the street wearing glasses when the prescription ran out.” by Steven Wright.
Just desire to say your article is as astounding. The clarity in your post is just cool and i could assume you’re an expert on this subject. Fine with your permission allow me to grab your feed to keep up to date with forthcoming post. Thanks a million and please keep up the rewarding work.