Yesterday (Thursday, September 7, 2023) Apple released emergency security updates for iOS, iPadOS, macOS, and watchOS to address two zero-day vulnerabilities that were exploited to spread NSO Group’s Pegasus spyware.
After the problems experienced a few months ago, Apple is once again fighting against a spyware called Pegasus from NSO Group that exploits two zero-day vulnerabilities.
The issues are described below:
• CVE-2023-41061 – A validation issue in Wallet that could lead to arbitrary code execution when handling a malicious attachment.
• CVE-2023-41064 – A buffer overflow issue in the Image I/O component that could lead to arbitrary code execution when processing a malicious image.
While CVE-2023-41064 was discovered by the Citizen Lab at the University of Toronto’s Munk School, CVE-2023-41061 was discovered internally by Apple, with “assistance” from the Citizen Lab.
The updates are available for the following devices and operating systems:
• iOS 16.6. 1 and iPadOS 16.6. 1 – iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
• macOS Ventura 13.5. 2 – macOS devices running macOS Ventura
• watchOS 9.6. 2 – Apple Watch Series 4 and later
In a separate alert, Citizen Lab revealed that the twin flaws were weaponized as part of a zero-click iMessage exploit chain called BLASTPASS, which was used to deploy Pegasus to fully patched iPhones on iOS 16.6.
“The exploit chain was able to compromise iPhones running the latest version of iOS (16.6) without any interaction from the victim,” the interdisciplinary lab said. “The exploit involved PassKit attachments containing malicious images sent from an attacker’s iMessage account to the victim.”
Further technical details about the various flaws were omitted in light of ongoing exploitation of the flaws by hackers. That said, the exploit is said to bypass the BlastDoor sandbox framework created by Apple to limit zero-click attacks.
“This latest discovery once again shows that civil society is being targeted by highly sophisticated attacks and high-performance spyware,” Citizen Lab said, adding that the issues were discovered last week during an examination of the device of an unidentified individual employed by an organization headquartered in Washington DC with other international locations.
Apple has so far fixed a total of 13 zero-day bugs in its software since the beginning of the year. The latest updates come more than a month after the company released fixes for an actively exploited kernel flaw.
The news of the zero-days comes as China’s government has ordered a ban on central and state government officials using iPhones and other foreign-branded devices for work, in a bid to reduce reliance on foreign technology and amid a growing trade crisis between China and the US.
“The real reason (for the ban) is: cybersecurity,” Zuk Avraham, a security researcher and founder of Zimperium, said in a post on X (formerly Twitter). “The iPhone has this image of being the most secure phone… but in reality, the iPhone is not secure at all against simple espionage.”
“Don’t believe me? Just look at the number of zero-click exploits that commercial companies like NSO have had available over the years, and you’ll see that there’s almost nothing an individual, organization, or government can do to protect themselves from iPhone cyberespionage.”
Yesterday (Thursday, September 7, 2023) Apple released emergency security updates for iOS, iPadOS, macOS, and watchOS to address two zero-day vulnerabilities that were exploited to spread NSO Group’s Pegasus spyware.
After the problems experienced a few months ago, Apple is once again fighting against a spyware called Pegasus from NSO Group that exploits two zero-day vulnerabilities.
The issues are described below:
• CVE-2023-41061 – A validation issue in Wallet that could lead to arbitrary code execution when handling a malicious attachment.
• CVE-2023-41064 – A buffer overflow issue in the Image I/O component that could lead to arbitrary code execution when processing a malicious image.
While CVE-2023-41064 was discovered by the Citizen Lab at the University of Toronto’s Munk School, CVE-2023-41061 was discovered internally by Apple, with “assistance” from the Citizen Lab.
The updates are available for the following devices and operating systems:
• iOS 16.6. 1 and iPadOS 16.6. 1 – iPhone 8 and later, iPad Pro (all models), iPad Air 3rd generation and later, iPad 5th generation and later, and iPad mini 5th generation and later
• macOS Ventura 13.5. 2 – macOS devices running macOS Ventura
• watchOS 9.6. 2 – Apple Watch Series 4 and later
In a separate alert, Citizen Lab revealed that the twin flaws were weaponized as part of a zero-click iMessage exploit chain called BLASTPASS, which was used to deploy Pegasus to fully patched iPhones on iOS 16.6.
“The exploit chain was able to compromise iPhones running the latest version of iOS (16.6) without any interaction from the victim,” the interdisciplinary lab said. “The exploit involved PassKit attachments containing malicious images sent from an attacker’s iMessage account to the victim.”
Further technical details about the various flaws were omitted in light of ongoing exploitation of the flaws by hackers. That said, the exploit is said to bypass the BlastDoor sandbox framework created by Apple to limit zero-click attacks.
“This latest discovery once again shows that civil society is being targeted by highly sophisticated attacks and high-performance spyware,” Citizen Lab said, adding that the issues were discovered last week during an examination of the device of an unidentified individual employed by an organization headquartered in Washington DC with other international locations.
Apple has so far fixed a total of 13 zero-day bugs in its software since the beginning of the year. The latest updates come more than a month after the company released fixes for an actively exploited kernel flaw.
The news of the zero-days comes as China’s government has ordered a ban on central and state government officials using iPhones and other foreign-branded devices for work, in a bid to reduce reliance on foreign technology and amid a growing trade crisis between China and the US.
“The real reason (for the ban) is: cybersecurity,” Zuk Avraham, a security researcher and founder of Zimperium, said in a post on X (formerly Twitter). “The iPhone has this image of being the most secure phone… but in reality, the iPhone is not secure at all against simple espionage.”
“Don’t believe me? Just look at the number of zero-click exploits that commercial companies like NSO have had available over the years, and you’ll see that there’s almost nothing an individual, organization, or government can do to protect themselves from iPhone cyberespionage.”