In recent events, tech giant Apple has issued security updates for a zero-day vulnerability that affects every iPhone, iPad, Mac, and Apple Watch. Internet security watchdog group, Citizen Lab discovered the NSO zero-day vulnerability and urged the users to immediately update their devices.
The Security Updates to Patch At Least One Vulnerability
Apple also stated that iOS 14.8 for iPhones and iPads, as well as new security updates for Apple Watch and macOS, will patch at least one vulnerability that it may have been actively exploited.
Moreover, Citizen Lab announced that it has now detected new artifacts of the ForcedEntry vulnerability, according to the company it was first unveiled in August as part of an investigation into the use of an NSO zero-day vulnerability that was employed to mutely hack into iPhones belonging to at least one Bahraini activist.
Pegasus Spyware to Exploit NSO Zero-Day Vulnerability
Last month, Citizen Lab stated that the NSO zero-day vulnerability took advantage of a flaw in Apple’s iMessage, which was misused to push the Pegasus spyware, produced by Israeli firm NSO Group, to the activist’s phone. Pegasus provides its state customers near-complete passage to a target’s device, including their private data, pictures, messages, and location.
Read more: Apple and Epic Games Both Suffer Losses in In Fortnite Legal Battle
Furthermore, in a brief statement, Apple’s head of security engineering and architecture Ivan Krstić confirmed the fix, stating “After identifying the vulnerability used by this exploit for iMessage, Apple rapidly developed security updates and deployed a fix in iOS 14.8 to protect our users. We’d like to commend Citizen Lab for successfully completing the very difficult work of obtaining a sample of this exploit so we could develop this fix quickly.”
ForcedEntry Evades Apple’s BlastDoor Protections
The breach was significant because the NSO zero-day vulnerability exploited the most recent iPhone software at the time, both iOS 14.4 and later iOS 14.6, which Apple released in May. Along with it also breached through new iPhone defenses that Apple had incorporated into iOS 14, dubbed BlastDoor, which were deemed to block silent attacks by filtering potentially malicious code. Citizen Lab calls this particular exploit ForcedEntry for its capacity to dodge Apple’s BlastDoor protections.
Source: TechCrunch
