Apple Patches a NSO Zero-Day Flaw Affecting All Devices

Apple has released security updates for a newly discovered zero-day vulnerability that affects every iPhone, iPad, Mac and Apple Watch. Citizen Lab, which discovered the vulnerability and was credited with the find, urges users to immediately update their devices. From a report: The technology giant said iOS 14.8 for iPhones and iPads, as well as new updates for Apple Watch and macOS, will fix at least one vulnerability that it said "may have been actively exploited." Citizen Lab said it has now discovered new artifacts of the ForcedEntry vulnerability, details it first revealed in August as part of an investigation into the use of a zero-day vulnerability that was used to silently hack into iPhones belonging to at least one Bahraini activist.

Last month, Citizen Lab said the zero day flaw -- named as such since it gives companies zero days to roll out a fix -- took advantage of a flaw in Apple's iMessage, which was exploited to push the Pegasus spyware, developed by Israeli firm NSO Group, to the activist's phone. Pegasus gives its government customers near-complete access to a target's device, including their personal data, photos, messages and location.

"Named such because..."

[mark-t]

Citizen Lab said the zero day flaw -- named as such since it gives companies zero days to roll out a fix ...

I al;ways thought zero-day flaw referred to the number of days that it took to discover the flaw since the last fix or security update.

Otherwise basically every flaw is a zero-day flaw, because a company never has any days to roll out a fix before they know about it.

Re:"Named such because..."

[gregarican]

I think "zero day" indicates that it's publicly disclosed, so that the vendor has no heads-up to patch it. There have been many cases where the discoverer notifies the vendor privately so that the vendor has an opportunity to patch it. Of course those premises go back to the days when there hasn't been a 24x7 news cycle, social media firestorms, etc.

Re:

[mark-t]

Which would apply to any publicly known bug or flaw for which no fix happens to yet be available. Basically it becomes a catch-all phrase for any unpatched exploit. Why the fuck even bother with the buzzword "zero-day", then?

It becomes an overbroad net that completely ignores whether or not the company might have even been actively working on getting a fix ready but the bug was disclosed before they had issued the update, and so effectively ignores its own supposed criteria of whether or not the compa

Re:

[Gimric]

Some exploits are discovered before they are exploited in the wild. These are not zero day bugs and don't become zero day bugs just because a patch becomes public.

You can't misinterpret something and then complain that it's a meaningless term based on your misunderstanding. Maybe try to understand how things actually work before shooting off your mouth.

Re:

[mark-t]

Of course, but that doesn't change the fact that you are effectively defining zero-day flaw to be any publicly known exploit for something that does not have a patch at the time the exploit is known.

Which is all but wholly meaningless. What is the difference between "zero-day" and "unpatched exploit"?

Re:

[mark-t]

My point is that anything that is publicly disclosed to everybody at the same time is a so-called "zero day" flaw. The term doesn't really mean anything different than "newly discovered bug" Absolutely anything that you just found out about you have zero days of notification on, so it's a ridiculous term unless the zero si in relation to some other point that doesn't start counting when the bug itself is discovered.

Re:

[mark-t]

If it's already been fixed or the company already knows about it then it's not newly discovered in the first place, is it?

what about iPhone 5?

[anasciiman]

I wonder if this affects my ancient iPhone 5 (no "S") ;)

Re:

[bill_mcgonigle]

Probably - somebody was saying elsewhere that it's the GIF interpreter.

If you're using an iPhone 5 on the Internet or phone network you should assume adversaries are on it. That's unfortunate but the state of technology.

Re:

[Anonymous Coward]

Nope, it's a PDF vulnerability in CoreGraphics. Oddly the content of CVE-2021-30860 [mitre.org] has been withdrawn from MITRE Corp., but the gist of it is still mentioned in HT212806 [apple.com] on Apple's site.

Android

[ArchieBunker]

People with Android phones asking, what's an update?

Re:

[DigitAl56K]

Mostly true. However, with Pixel 6 running on custom hardware, Google finally seems to be promising 5 years of updates. One wonders if Qualcomm will finally see the light? Probably not...

Re:

[tlhIngan]

Mostly true. However, with Pixel 6 running on custom hardware, Google finally seems to be promising 5 years of updates. One wonders if Qualcomm will finally see the light? Probably not...

Qualcomm makes money selling chips. Short update cycles mean they sell more chips. It's in their interest to not offer updates.

Re:

[iampiti]

More phone makers have to come onboard with this. I'd pay more money for a phone with more time of officially supported updates.

Ouch

[kackle]

I wonder whether my friend just got hit with this. His Apple laptop, tablet and phone all started acting funny, and he was unable to "reset" them, he said. Then, they started turning themselves on without intervention. Creepy.

He had an idea: Run their batteries down until he could deal with their repair. I also thought that putting them in an (non-running!) microwave oven might block their radio signals, too. But he's still concerned that his identity was filched.

Media not reporting as "Israeli hacking"?

[BardBollocks]

Anyone in Russia hacking and it's Russian hacking.

Anyone in China hacking and it's Chinese hacking.

Anyone in Israel hacking and it's....?

You'd have to be a complete dickhead to not spot the obvious hypocrisy and its part in weaving the whole modern narrative of bullshit we're force fed.

Re:

[khchung]

Anyone in Russia hacking and it's Russian hacking.

Anyone in China hacking and it's Chinese hacking.

Anyone in Israel hacking and it's....?

You'd have to be a complete dickhead to not spot the obvious hypocrisy and its part in weaving the whole modern narrative of bullshit we're force fed.

This is nothing new. Just check the headlines here in /. in the last 20 years and you will find the same pattern.

Anything bad from Russia/China/etc, it will be “Russian xxxx did xxx”, while American/Israeli did the same thing, it would be “[specific group] did xxx”. This case being a perfect example, if NSO were Russian, the headline would surely be “... Patches a Russian exploit ...”

Always associate Russia/China with bad acts, while avoiding the same for the US and all

You were saying, Craig Federighi?

[Chuck Hamlin]

"It's well understood in the security community that Android has a malware problem that iOS has succeeded in staying ahead of."

There may be problems with this update

[Zontar_Thing_From_Ve]

Apple may have rushed this out too quickly. I just had the update fail on me with an unhelpful error message. I'm trying again but if that fails, I'll have to fall back to a restore. Caveat emptor.

Re:

[not flu]

Worked fine for me.