New Flaw in Apple Devices Led To Spyware Infection, Researchers Say (reuters.com) 35
Researchers at digital watchdog group Citizen Lab say they found spyware they linked to Israeli firm NSO that exploited a newly discovered flaw in Apple devices. From a report: While inspecting the Apple device of an employee of a Washington-based civil society group last week, Citizen Lab said it found the flaw had been used to infect the device with NSO's Pegasus spyware, it said in a statement.
Bill Marczak, senior researcher at Citizen Lab, said the attacker likely made a mistake during the installation which is how Citizen Lab found the spyware. Citizen Lab said Apple confirmed to them that using the high security feature "Lockdown Mode" available on Apple devices blocks this particular attack. The flaw allowed compromise of iPhones running the latest version of iOS (16.6) without any interaction from the victim, the digital watchdog said. The new update fixes this vulnerability.
Bill Marczak, senior researcher at Citizen Lab, said the attacker likely made a mistake during the installation which is how Citizen Lab found the spyware. Citizen Lab said Apple confirmed to them that using the high security feature "Lockdown Mode" available on Apple devices blocks this particular attack. The flaw allowed compromise of iPhones running the latest version of iOS (16.6) without any interaction from the victim, the digital watchdog said. The new update fixes this vulnerability.
Re:Lockdown Mode (Score:5, Insightful)
Lockdown isn't the default because it trades a ton of features that we all use on a near daily basis for the hardened security posture. Normal people do not have to worry about attacks like these. No black hat worth their salt is going to waste an iOS zero day on John Q. Public. These are things you need to worry about if you are a high profile activist/dissident, high level government employee, terrorist/rebel, or C-suite executive for a billion/trillion dollar corporation.
To quote South Park [cc.com], "You are fat and unimportant."
Re: (Score:3)
Re: (Score:2)
As an Android user am I missing something?
Google makes many of these features opt-in, to the point of annoying its users with one too many security popups.
Trusting random people in messages or websites sounds like waiting to be phished.
Re: (Score:2)
There's no 'trust' if someone finds an exploit that doesn't require user interaction. Read the history of Pegasus and FORCEDENTRY. The exploit that prompted this story was another one that did not require user interaction.
The point of lockdown mode is it reduces the attack surface for such attempts by disabling a lot of functionality. Functionality your Grandma is going to complain about losing but Grandma is (hopefully) not worried about being targeted by someone with nation-state resources.
If you ar
Re: (Score:2)
Android has *dozens* of micro-permissions. Allow once, allow always, deny.
By that 'it reduces the attack surface for such attempts by disabling a lot of functionality.' But you, the power user are in complete control and not just one global mode. This means you can explain to Grandma that you have permanently shrunk the attack surface by default and only enable the bare minimum she might need.
Not to downplay the sophistication or ruthlessness of Pegasus operatives but one global mode that virtually no one a
Re: (Score:2)
Exactly.
The thing is, finding flaws is what NSO group does, and iOS has many OS level features that make exploiting them hard. So hard, they're worth millions of dollars each.
So the NSO group stuff is only deployed really as a matter of last resort - you pay them several hundred thousands of dollars for them to infect ONE specific phone. They won't allow use of it to infect a whole bunch of phones because that would result in detection of the flaw and fixes.
Also, you can be sure Israel and other country gov
Re: (Score:2)
Honestly, even if you're one of the Jan 6 people, you likely didn't even qualify as that data was probably easily available elsewhere.
The US Government wouldn't burn an iOS zero day on prosecuting what amounts to a poorly planned riot. Particularly when many of the suspects were stupid enough to film their Federal felonies and post the footage on social media. The Government might not even burn an iOS zero day for a serious terrorism or espionage case. They burned one for the San Bernardino attacks [wikipedia.org] but those suspects were already dead, so it was unlikely the Government would have to reveal the method in court, and if they had to it wou
Re: (Score:2)
The thing is, finding flaws is what NSO group does, and iOS has many OS level features that make exploiting them hard.
OS level features like what? When iOS gets hit, the attack vectors are often embarrassingly bad. For example, there have been a lot of exploits in iOS that were the result of TEXT PARSING bugs leading to security vulnerabilities. If an exploit vector is through a text parsing bug, you've got some pretty terrible coding practices backed by what's almost certainly even worse exploit mitigation. Apple's security model, from what I've observed, seems to rely primarily upon code signing, followed by security thr
Re: (Score:2)
iOS users tend to be politicians and/or celebrities and/or tend to have money to burn, which means they're going to skew towards being high value targets overall.
What crowd are you hanging out with??? The iPhone people in my personal and professional circle run the gamut from working poor to mildly rich. The iPhone SE is a thing, you can have one brand new for ~$400. The camera, modem, display, etc., aren't as nice as the flagship models but the software experience is the same.
Re: Lockdown Mode (Score:2)
...That last sentence you wrote...Notice anything?
Re: Lockdown Mode (Score:2)
Re: (Score:1)
That's not flame bait. It's true. I'm not fat. Bad mod is fat. Fat fat fat greasy potato chips blast zone fat.
Lol, fat mod triggered, hehe
buy/hire them (Score:1)
Apple should be buying or at least hiring the NSO group to prevent these flaws from the start. Apple has enough money, its about economics at the end of the day.
Re: (Score:2)
Re: (Score:2)
Apple makes about half their revenue from selling iPhones. [ref [statista.com]] Services is taking an increasing percentage (close to 25% in recent quarters), but hardware still dominates.
Re: (Score:2)
Apple makes about half their revenue from selling iPhones. [ref [statista.com]] Services is taking an increasing percentage (close to 25% in recent quarters), but hardware still dominates.
You can't easily separate the hardware from the software. iPhone without iOS is an overpriced paperweight. Most Apple customers are paying for the Apple Experience and their software is foundational for that. Hardware spec wise there isn't much difference these days between iPhone and other flagship devices. Heck, iPhone frequently lags behind the competition on hardware advancements, but Apple still dominates sales because of the Apple Experience, whether you love or hate them.
Apple has a better track
Re: (Score:2)
More so than anything else, Apple is a services company today.
Apple is a luxury name brand now. It really doesn't matter what they sell.
Re: (Score:1)
Re: (Score:2)
Clearly, Apple is not finding the flaws themselves and NSO is finding the flaws. This is a path to software improvement.
Re: (Score:3)
NSO probably figures they make more money as an independent company, since they can charge top dollar to governments, criminal organizations, etc.
Re: (Score:2)
That is where Apple's deep pockets come in.
Re: (Score:2)
Spain used Pegasus against political rivals. At the time, and now, Apple is bigger than Spain. Apple can afford to pay more for exploits.
https://www.visualcapitalist.c... [visualcapitalist.com]
https://www.theguardian.com/wo... [theguardian.com]
Re: (Score:2)
Apple should be buying or at least hiring the NSO group to prevent these flaws from the start. Apple has enough money, its about economics at the end of the day.
Logic Fail.
The NSO Group did not create the flaws. They exploit the flaws. Apple created the flaws when they created the hardware/software. If NSO shut down the flaws would still exist, still be discovered by hackers, and still be sold on the black market for exploitation -just not to NSO.
The headline and summary above bill this as a new flaw. It is not new. It has existed and been exploited by spyware makers (such as the NSO group) for an unspecified time. Apple has just newly discovered and patched
Re: (Score:2)
Hey ID10T, you missed my point. I didn't say put NSO out of work, I said put them to work for Apple. I'm saying that Apple needs to hire better code breakers and NSO has them, and Apple has the cash to make it work. If Apple, internally, can find an fix more flaws before release then we are all better off. I never said this path solves all problems, it could be an improvement though.
Re: (Score:2)
NSO buys exploits ..
Re: buy/hire them (Score:2)
Patch Available (Score:2)
Re: (Score:2)
iOS 16.6.1 has been released [apple.com], specifically to fix this.
Got a notice about 4 hours ago.
Re: Patch Available (Score:2)