Apple releases emergency patch after Pegasus spyware breach

Receive free updates from Apple Inc.

We will send you a myFT Daily Summary email summarizing the latest Apple Inc. news every morning.

Apple has released an emergency software update after being warned that a previously unknown vulnerability allowed Israeli group NSO to remotely and surreptitiously inject its Pegasus spyware into iPhones and iPads.

The weakness in iOS code, called zero-day, appears to have allowed NSO customers, including Saudi Arabia, Rwanda and Mexico, to hide code in images sent via iMessage, which would allow Pegasus spyware military grade to take control of an iOS code. phone functions.

Pegasus is able to surreptitiously read encrypted messages stored on the phone, turn on its camera and microphone remotely, and constantly track the phone’s location. It has been linked to human rights abuses from Mexico to East Africa, leading to the Israeli company being blacklisted by the US Department of Commerce.

The patch also fixes a vulnerability that affected Apple Wallet, where people store payment cards, the company said in a brief statement late Thursday without providing further details as it rolled out the update to billions of phones.

This latest patch, among the few released by Apple in recent years, continues the cat-and-mouse game between major US tech companies and spyware makers, many of them Israel-based, who exploit and then market unknown vulnerabilities. in smartphones so that their clients, which are usually government agencies, can monitor thousands of targets undetected.

NSO said: “We are unable to respond to claims that do not include any supporting research. »

While NSO has maintained that its product is only intended to monitor potential terrorists and fight organized crime, this vulnerability was discovered by the Citizen Lab at the University of Toronto, who said they found it on the phone. from an employee based in Washington, DC. a “civil society” organization with international offices.

Citizen Lab has already traced the spyware to the phones of hundreds of dissidents, journalists, lawyers and opposition leaders in countries with poor human rights records.

The US government blacklisting was prompted by the discovery of Pegasus on the phones of US Embassy employees in Uganda, leading to spyware such as NSO’s being listed as a threat major for US government counterintelligence and national security.

The discovery of the latest vulnerability underscores how NSO continues to uncover rare weaknesses in some sophisticated operating systems, despite serious financial problems resulting from US government sanctions against it.

Staffed almost entirely by veterans of the Israeli army’s elite signals intelligence units, the company was once valued at $1 billion by its London-based private equity fund, Novalpina Capital.

But a hack designed in 2019 by NSO to inject its spyware using a vulnerability in the ubiquitous messaging platform WhatsApp has resulted in a lawsuit in California court by WhatsApp owner Meta, joined by Apple, Amazon and other tech giants.

In that lawsuit, which is ongoing, NSO argued that its actions should be immune from legal scrutiny since its software is used by sovereign countries and the company has no visibility into the targets.

In recent weeks, at least three other people, including a UK-based Daily Mail political reporter, have received notifications from Apple that their phones had been attacked by “state actors.” It is not yet clear whether these attacks came from NSO’s systems or those of its competitors.

“These attackers are likely targeting you individually because of who you are or what you do,” the notification reads.