The Citizen Lab concludes its report on FORCEDENTRY on a surprisingly optimistic note, predicting that “NSO Group’s business model contains the seeds of their ongoing unmasking. The Real Dangers of the Nord Stream Pipeline Leaks Turns Out Vets Think Jonathan Van Ness’ Pet Food Company Is Ridiculous, Too News of yet more bad behavior by NSO Group feels a little like déjà vu, but each and every zero-click zero-day is still a big deal, every single time. That short timeline is a sign of both Apple’s engineering prowess and just how seriously the company took this exploit. Apple then analyzed them, identified the exploit they took advantage of, and released the relevant patches less than a week later. gif files on the phone backup and sent those files to Apple on Sept. The Citizen Lab researchers identified several suspicious. The Citizen Lab was only able to alert Apple to the problem because earlier this year a Saudi activist who had been targeted by the NSO Group Pegasus spyware provided the Citizen Lab with an iTunes backup of their phone for the researchers to analyze. It’s also part of why NSO Group is so widely regarded with suspicion and hostility: It’s not just selling spyware to governments to use on journalists, dissidents, and activists-it’s selling incredibly advanced spyware the likes of which many of the countries NSO sells to probably would not be able to develop on their own.Īnd because these zero-click exploits are so passive, they’re often also hard to detect and trace users can’t easily look back through their emails or downloads to identify a particular suspicious message or file. That’s what makes exploits like the one announced Monday so dangerous and so scary even to people who are vigilant about cybersecurity. That’s why FORCEDENTRY is described as a “zero-click” exploit (not to be confused with a zero-day exploit, which is an exploit that has never before been discovered or patched-and which also applied to FORCEDENTRY). But one of the hallmarks of NSO Group’s tools is that many of them can infect devices without even requiring the device owner to click on or download anything. That’s also why so much basic cyber hygiene guidance focuses on encouraging you to double-check the “from” addresses in your email or heed browser warnings-generally speaking, it’s difficult for someone to compromise your computer without tricking you into downloading something or revealing your credentials at some point along the way. That’s because many cybersecurity incidents begin with a moment of carelessness-someone opens an email attachment they shouldn’t have, or fills out a form on an insecure website, or sticks an unfamiliar USB drive into their computer. (Until Monday! Go update all your Apple devices immediately! Finish this article afterward! Here’s how to update your iPhone, Apple Watch, and macOS for desktop or laptop.)Īnyone can infiltrate 50,000 cellphones, but compromising phones that belong to journalists and activists who are taking cyber hygiene seriously is an entirely different-and much harder-task. It could be used to compromise all Apple phones, tablets, computers, and watches-and worse, since it could be used to infect those devices without a person actively clicking on anything to download malicious code, it was all but impossible to protect against. While the news that NSO Group is helping governments infiltrate smartphones and computers using sophisticated exploits and vulnerabilities is not surprising, the reach and ease of this latest exploit, dubbed FORCEDENTRY by Citizen Lab, is still pretty stunning. The Citizen Lab researchers released a report that same day detailing how they had come across the exploit Apple patched by examining the phone of a Saudi activist who had been targeted using NSO Group’s controversial Pegasus spyware. On Monday, Apple announced that it was releasing emergency security updates for its iOS and MacOS operating systems after the company discovered a new zero-click vulnerability with help from researchers at the University of Toronto’s Citizen Lab.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |