Apple released security updates on Thursday that patch two zero-day exploits — that is, hacking techniques that were unknown at the time Apple found out about them — that were used against a member of a civil society organization in Washington, D.C., according to the researchers who discovered the vulnerabilities. the wish .
Citizen Lab, an internet monitoring group that investigates government malware, Publish a short blog post Explaining that last week they discovered a zero-click vulnerability – meaning the hackers’ target does not need to tap or click on anything, such as an attachment – used to target victims with malware. Researchers said the vulnerability was used as part of an exploit chain designed to deliver malware to NSO Group, known as Pegasus.
“The exploit chain was able to compromise iPhones running the latest version of iOS (16.6) without any interaction from the victim,” Citizen Lab wrote.
Once the vulnerability was found, researchers reported it to Apple, which issued a patch on Thursday, and thanked Citizen Lab for reporting it.
Based on what Citizen Lab wrote in the blog post, and the fact that Apple also patched another vulnerability and attributed its findings to the company itself, it appears that Apple may have found the second vulnerability while investigating the first.
When reached for comment, Apple spokesperson Scott Radcliffe did not comment and referred TechCrunch to the notes in the security update.
Citizen Lab said it named the exploit chain BLASTPASS, because it was involved Basketa framework that allows developers to embed Apple Pay into their apps.
“Once again, civil society is acting as a cybersecurity early warning system for billions of devices around the world,” says John Scott-Railton, a senior researcher at internet watchdog Citizen Lab. books On Twitter.
Citizen Lab recommends that all iPhone users update their phones.
NSO did not immediately respond to a request for comment.
Do you have more information about NSO Group or any other surveillance technology provider? Or information about similar hacks? We would love to hear from you. You can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, via Wickr, Telegram, Wire @lorenzofb, or by email lorenzo@techcrunch.com. You can also contact TechCrunch via SecureDrop.