Apple releases urgent security update to all iPhone, iPad and Mac users

[ad_1]

Apple has released an important software patch to fix a major security vulnerability, after researchers found that spyware could exploit it to hack iPhones and other Apple devices directly without a click from the user.

Researchers at Citizen Lab at the University of Toronto said they found malicious image files being transferred to the phone of a Saudi activist, who wished to remain anonymous, via instant messaging app iMessage. The device was then hacked by the Pegasus spyware developed by the Israeli NSO group, they claimed.

Citizen Lab, which called the iMessage a Forcedentry exploit, said the vulnerability makes phones vulnerable to eavesdropping and remote data theft, and that it applies to all Apple devices. Forensic medicine revealed that the activist’s phone was infected last March, adding that malicious files caused the phone to malfunction.

The vulnerability was found in the activist’s iPhone on September 7, after which Citizen Lab said it alerted Apple immediately. NSO Group has licensed the Pegasus spy tool to government agencies and police forces to investigate criminal activity, but Citizen Lab researcher Bill Marczak said: “We don’t necessarily attribute this attack to the Saudi government.”

The NSO Group issued a statement saying it would continue to provide tools to fight “terrorism and crime”.

Also a “zero-click” exploit, Pegasus does not require users to click any suspicious link or open infected files and is considered the pinnacle of monitoring technology, allowing hackers to hack a person’s phone without alerting the victim.

Apple, in a blog post, said it was releasing a security update for iPhone and iPad, because a “malicious” PDF file could lead to hacking. Apple’s chief security officer, Ivan Kristek, also issued a statement saying, “After identifying the vulnerability used by this exploit for iMessage, Apple quickly developed and deployed it in iOS 14.8 to protect our users.”

In the past, he added, such vulnerabilities typically cost millions of dollars to develop and usually had a short shelf life. Although it is currently unclear how many Apple users may have been attacked with this vulnerability, Mr. Krstic said such vulnerabilities “do not pose a threat to the vast majority of our users”.

Users should receive alerts on their iPhone asking them to update the phone’s iOS software. The important update comes ahead of an Apple event on Tuesday where the tech company is set to unveil a new product.

Citizen Lab claimed that their findings undermine the Israeli company’s assertion that it sells software to law enforcement officials for use against criminals and terrorists and audits customers to ensure Pegasus is not misused.

“If Pegasus had only been used against criminals and terrorists, we would not have found these things,” Marczak said.

Earlier in July, a global media consortium published a series of reports on Pegasus being used to spy on journalists, activists, opposition leaders and political opponents.

Reports revealed that the phone of the fiancée of Washington Post journalist Jamal Khashoggi was infected with the program just four days after he was killed in the Saudi consulate in Istanbul in 2018. The CIA blamed the Saudi government for the killing.

The disclosure also led to protests in Parliament against the government of Indian Prime Minister Narendra Modi for allegedly using spyware against political opponents. The government has so far neither accepted nor denied the allegations of intrusion.

In Hungary, spying reports have led to calls for an investigation against the right-wing government, while in France the government is also trying to investigate allegations that an unidentified Moroccan security service used Pegasus to target President Emmanuel Macron and members of his government. In 2019. Morocco, a French ally, denied the allegations.

Additional reports from agencies

[ad_2]