New Flaw in Apple Devices Led To Spyware Infection, Researchers Say

Researchers at digital watchdog group Citizen Lab say they found spyware they linked to Israeli firm NSO that exploited a newly discovered flaw in Apple devices. From a report: While inspecting the Apple device of an employee of a Washington-based civil society group last week, Citizen Lab said it found the flaw had been used to infect the device with NSO's Pegasus spyware, it said in a statement.

Bill Marczak, senior researcher at Citizen Lab, said the attacker likely made a mistake during the installation which is how Citizen Lab found the spyware. Citizen Lab said Apple confirmed to them that using the high security feature "Lockdown Mode" available on Apple devices blocks this particular attack. The flaw allowed compromise of iPhones running the latest version of iOS (16.6) without any interaction from the victim, the digital watchdog said. The new update fixes this vulnerability.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:

[ole_timer]

When Lockdown Mode is enabled, some apps and features will function differently, including: Messages - Most message attachment types are blocked, other than certain images, video, and audio. Some features, such as links and link previews, are unavailable. Web browsing - Certain complex web technologies are blocked, which might cause some websites to load more slowly or not operate correctly. In addition, web fonts might not be displayed, and images might be replaced with a missing image icon. FaceTime - Inc

Re:

[ChunderDownunder]

As an Android user am I missing something?

Google makes many of these features opt-in, to the point of annoying its users with one too many security popups.

Trusting random people in messages or websites sounds like waiting to be phished.

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[ChunderDownunder]

Android has *dozens* of micro-permissions. Allow once, allow always, deny.

By that 'it reduces the attack surface for such attempts by disabling a lot of functionality.' But you, the power user are in complete control and not just one global mode. This means you can explain to Grandma that you have permanently shrunk the attack surface by default and only enable the bare minimum she might need.

Not to downplay the sophistication or ruthlessness of Pegasus operatives but one global mode that virtually no one a

Re:

[tlhIngan]

Exactly.

The thing is, finding flaws is what NSO group does, and iOS has many OS level features that make exploiting them hard. So hard, they're worth millions of dollars each.

So the NSO group stuff is only deployed really as a matter of last resort - you pay them several hundred thousands of dollars for them to infect ONE specific phone. They won't allow use of it to infect a whole bunch of phones because that would result in detection of the flaw and fixes.

Also, you can be sure Israel and other country gov

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[ArmoredDragon]

The thing is, finding flaws is what NSO group does, and iOS has many OS level features that make exploiting them hard.

OS level features like what? When iOS gets hit, the attack vectors are often embarrassingly bad. For example, there have been a lot of exploits in iOS that were the result of TEXT PARSING bugs leading to security vulnerabilities. If an exploit vector is through a text parsing bug, you've got some pretty terrible coding practices backed by what's almost certainly even worse exploit mitigation. Apple's security model, from what I've observed, seems to rely primarily upon code signing, followed by security thr

Re:

[account_deleted]

Comment removed based on user account deletion

Re: Lockdown Mode

[ArmoredDragon]

...That last sentence you wrote...Notice anything?

Re: Lockdown Mode

[SleepingEye]

Fanboys, amirite

Re:

[iAmWaySmarterThanYou]

That's not flame bait. It's true. I'm not fat. Bad mod is fat. Fat fat fat greasy potato chips blast zone fat.

Lol, fat mod triggered, hehe

buy/hire them

[awwshit]

Apple should be buying or at least hiring the NSO group to prevent these flaws from the start. Apple has enough money, its about economics at the end of the day.

Re:

[flippy]

More so than anything else, Apple is a services company today. Plus, a determined attacker (like the NSO group) WILL eventually find a way into any internet-connected system. There's no way to keep an internet-connected system completely secure, it's a matter of time and effort.

Re:

[necro81]

Apple is a services company today

Apple makes about half their revenue from selling iPhones. [ref [statista.com]] Services is taking an increasing percentage (close to 25% in recent quarters), but hardware still dominates.

Re:

[account_deleted]

Comment removed based on user account deletion

Re:

[DesScorp]

More so than anything else, Apple is a services company today.

Apple is a luxury name brand now. It really doesn't matter what they sell.

Re:

[Merk42]

Why don't companies simply release flawless software that has 0 vulnerabilities! bing bong so simple!

Re:

[awwshit]

Clearly, Apple is not finding the flaws themselves and NSO is finding the flaws. This is a path to software improvement.

Re:

[93 Escort Wagon]

NSO probably figures they make more money as an independent company, since they can charge top dollar to governments, criminal organizations, etc.

Re:

[awwshit]

That is where Apple's deep pockets come in.

Re:

[awwshit]

Spain used Pegasus against political rivals. At the time, and now, Apple is bigger than Spain. Apple can afford to pay more for exploits.

https://www.visualcapitalist.c... [visualcapitalist.com]

https://www.theguardian.com/wo... [theguardian.com]

Re:

[Local ID10T]

Apple should be buying or at least hiring the NSO group to prevent these flaws from the start. Apple has enough money, its about economics at the end of the day.

Logic Fail.

The NSO Group did not create the flaws. They exploit the flaws. Apple created the flaws when they created the hardware/software. If NSO shut down the flaws would still exist, still be discovered by hackers, and still be sold on the black market for exploitation -just not to NSO.

The headline and summary above bill this as a new flaw. It is not new. It has existed and been exploited by spyware makers (such as the NSO group) for an unspecified time. Apple has just newly discovered and patched

Re:

[awwshit]

Hey ID10T, you missed my point. I didn't say put NSO out of work, I said put them to work for Apple. I'm saying that Apple needs to hire better code breakers and NSO has them, and Apple has the cash to make it work. If Apple, internally, can find an fix more flaws before release then we are all better off. I never said this path solves all problems, it could be an improvement though.

Re:

[Local ID10T]

NSO buys exploits ..

Re: buy/hire them

[SleepingEye]

Why would they waste money buying nso? Their users believe their idevices are impenetrable despite being proven time and again their software and app stores are leaky. Look how many people defend them in batterygate, completely missing the point of "Hey, your battery seems to be dying, you should replace it", instead focusing on "oh, they did it so it doesn't turn off on high loads"

Patch Available

[necro81]

iOS 16.6.1 has been released [apple.com], specifically to fix this.

Re:

[NoMoreACs]

iOS 16.6.1 has been released [apple.com], specifically to fix this.

Got a notice about 4 hours ago.

Re: Patch Available

[SleepingEye]

That's great. Now how many exploits aren't disclosed and are unpatched?