Apple releases macOS, iOS, iPadOS, and watchOS updates to address two zero-day flaws that Citizen Lab says were used to deliver NSO Group's Pegasus spyware

Apple released software updates on Thursday to address two zero-day vulnerabilities that researchers said were used …

The Record 2023-09-08 Joe Warminsky

Discussion

@jsrailton John Scott-Railton on x
🚨 Update your @apple products immediately! Last week we @citizenlab discovered a new #Pegasus zero-click exploit chain. (No clicking required to infect latest iOS!) Found while checking civil society. Disclosed to Apple which rushed a patch 1/ https://citizenlab.ca/... [image]
@billmarczak Bill Marczak on x
We refer to the exploit as BLASTPASS, as it employed a PassKit (Wallet) attachment containing a malicious image, sent via iMessage. When the phone processed the attachment, the exploit hijacked control of Apple's “BlastDoor” framework for iMessage security.
@tomwarren Tom Warren on x
Apple just fixed a massive iPhone security vulnerability today, with its iOS 16.6.1 release. “The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim.” 😵🥴😬 https://citizenlab.ca/... [image]
@maddiestone Maddie Stone on x
Two ITW 0-days for iOS: ImageIO (CVE-2023-41064) discovered by Citizen Lab & Wallet (CVE-2023-41061) discovered by Apple. This is the first time that Apple has been publicly credited for an ITW 0day since we began tracking in 2014! Thank you Apple! 🥳 https://support.apple.com/...
@jsrailton John Scott-Railton on x
4/ UPDATE on #BLASTDOOR exploit: We believe, and @Apple's Security Engineering and Architecture team has confirmed to us, that Lockdown Mode blocks this particular attack. (Obviously you should also make sure to update!) [image]
@msuiche Matt Suiche on x
Given that the name is “BLASTPASS” and the target is iMessage, I assume this means that this the first zero click exploit caught which includes a BlastDoor sandbox bypass introduced in iOS 14 2021. 🥲
@citizenlab @citizenlab on x
🚨🚨WE URGE EVERYONE TO UPDATE THEIR APPLE DEVICES AS SOON AS POSSIBLE. We have found an actively exploited #zero #click vulnerability that was used to deliver #NSO group's #Pegasus #spyware. https://citizenlab.ca/...
@billmarczak Bill Marczak on x
Today, Apple released iOS 16.6.1, patching two vulnerabilities exploited by BLASTPASS in Wallet (CVE-2023-41061) and ImageIO (CVE-2023-41064) so update your iPhones! Also, if you're at risk because of who you are or what you do, please enable Lockdown Mode https://support.apple.c…
@evacide Eva on x
Everybody go update your iPhones. The new 0-click vuln exploited by NSO Group is sent via a malicious image in iMessage. https://citizenlab.ca/...
@billmarczak Bill Marczak on x
NEW: Last week, we @citizenlab captured a “zero-click” exploit used to install Pegasus on the latest version of iOS, 16.6. The exploit installed Pegasus without any interaction from the victim, and was virtually invisible https://citizenlab.ca/...
@jsrailton John Scott-Railton on x
2/ We found the #BLASTPASS exploit chain thanks to an unnamed victim. Once more, civil society, is serving as the cybersecurity early warning system for... billions of devices around the world. Including you, if you're reading this on your iPhone. Or Mac. [image]
r/apple r on reddit
iPhone hacked through malicious pass sent via iMessage

Chronicles

Apple releases macOS, iOS, iPadOS, and watchOS updates to address two zero-day flaws that Citizen Lab says were used to deliver NSO Group's Pegasus spyware

Related Coverage

Discussion