This is not a drill!
If you own any Apple devices (Apple iOS, macOS, and watchOS), you need to update them as soon as possible to prevent potential hacking!
Apple issued emergency security patches for two serious vulnerabilities that are being actively exploited to hack into activists’ and reporters’ devices. Released on Monday, the security updates can fix at least one of these vulnerabilities that the tech experts said: “may have been actively exploited.”
In a Monday’s report, Apple described these two issues as following:
- Traced as CVE-2021-30858, this vulnerability is found in the WebKit browser, affecting iPhone 6s and advanced versions, iPad Air 2 and above, iPad Pro (all models), iPad mini-4, iPad 5th generation and above, and 7th generation iPod touch.
This vulnerability can lead to arbitrary code execution if you process any maliciously crafted web content. Additionally, the company itself confirms the reports of active exploitation of this vulnerability. - Tacked as CVE-2021-30860, it plants itself in the Core Graphics vector drawing framework that can be exploited via infected PDF to execute arbitrary code on the target’s device. The patch is available for iPad Pro (all models), iPhone 6s and later version, 5th generation iPad and later, iPod Touch (7th generation) iPad mini 4 and above, and iPad 5th generation and above.
The vulnerability was first discovered by the University of Toronto’s Citizen Lab, a part of Munk School of Global Affairs and Public Policy, which investigates the exploit of technology. The institution’s latest discovery involves installing Pegasus spyware, owned by an Israeli cybersecurity company called NSO Group, on iOS devices.
According to the cybersecurity watchdog, these vulnerabilities are being used to spy on Bahraini activists via Pegasus Spyware illegally. While carefully analyzing the Pegasus-infected iPhone of a Saudi activist, researchers discovered a zero-click exploit against the iMessaging feature. They named it “Forced Entry,” which targets Apple’s image rendering library and can be exploited through a malicious PDF. The agency claimed that it has been in use since at least February.
Citizen Lab immediately reported it to Apple for fixes.
“Our latest discovery of yet another Apple zero-day employed as part of NSO Group’s arsenal further illustrates that companies like NSO Group are facilitating “despotism-as-a-service” for unaccountable government security agencies,” said Citizen Lab. “Regulation of this growing, highly profitable, and the harmful marketplace is desperately needed.”
🚨 UPDATE YOUR APPLE DEVICES NOW🚨
We caught a zero-click, zero day iMessage exploit used by NSO Group’s #Pegasus spyware.
Target? Saudi activist.
We reported the #FORCEDENTRY exploit to @Apple, which just pushed an emergency update.
THREAD 1/https://t.co/dVuC1r1yUs pic.twitter.com/KHwtsWRcpA
— John Scott-Railton (@jsrailton) September 13, 2021
Hackers have increasingly been using Pegasus to spy over political figures, journalists, and activists. Toby Lewis, head of threat analysis at Darktrace, also highlighted the increasing number of Pegasus exploits to gain access to the target’s device. “Fundamentally, they have access to a range of Apple and Android vulnerabilities that would allow them to exploit a range of native applications (pre-installed on the devices), often just by trying to open a file sent in an email or over text message; or clicking on a link that opens in Safari. In addition, the exploits allow them to jailbreak the device, give them elevated privileges to install additional applications, or configure the device however the attackers want – including installing the spyware component of Pegasus.”
This software can harvest sensitive information from the target’s device, including messages, photos, or call records. It can also activate your microphone remotely to record conversations or film you through your mobile camera. In short, the Pegasus software can turn your smartphone into a 24/7 surveillance device.
Hence, it is advised to update your iOS devices immediately. However, if you feel that your device is still susceptible to online security threats, click on this article and read how you can thwart the attempts of smartphone hackers just by a single restart button.