Saturday, September 9, 2023

NSO Group - Blastpass zero click spyware for iPhone

Apple has moved to patch two zero-click, zero-day vulnerabilities in its mobile operating system, which has been used by Israeli cyber software company NSO Group in its Pegasus spyware. Citizen Lab published a disclosure notice revealing that the two flaws form an exploit chain it has dubbed Blastpass. Citizen Lab confirmed the chain was capable of compromising iPhones running version 16.6 of iOS, the latest version, without any interaction from the victim. Users should install Apple’s emergency updates immediately to patch the flaws. Use caution opening email attachments and random images. “This latest find shows once again that civil society is targeted by highly sophisticated exploits and mercenary spyware.”
The RCMP submitted a document to parliament outlining how a special team covertly infiltrates mobile devices of Canadians. The tools were used on at least 10 investigations between 2018 and 2020. Cops have access to text messages, email, photos, videos, audio files, calendar entries and financial records. Critics say the spyware has little to no oversight. Called the Pegasus project, an investigation revealed that spyware licensed by the Israeli firm NSO Group had been used to hack smartphones belonging to journalists, lawyers and human rights activists around the world. RCMP has been evasive and misleading about how it conducts surveillance on Canadians. Canada’s privacy commissioner found cops had broken the law six times when it used mobile device identifiers, known as IMSI catchers or stingrays.
Pegasus spyware has become a source of controversy across the globe. It emerged in 2020 that mobile phones belonging to Spain's prime minister and defence minister were infected by Pegasus spyware.
Dutch police used the controversial Israeli spyware to catch Kinahan associate Ridouan Taghi. Pegasus is spyware developed by Israeli cyber-arms company NSO Group that can be covertly installed on mobile phones (and other devices) running most versions of iOS and Android. Pegasus is able to exploit iOS versions through a zero-click exploit. Pegasus is capable of reading text messages, tracking calls, collecting passwords, location tracking, accessing the target device's microphone and camera, and harvesting information from apps.