Apple repairs computer flaw linked to Pegasus spy software

Apple announced on Monday September 13 that it had fixed a computer flaw that the controversial software Pegasus, from the Israeli company NSO, was able to exploit to infect the brand’s devices.

The flaw was spotted by researchers from Citizen Lab, who discovered that a Saudi activist’s iPhone had been infected via iMessage, Apple’s messaging system. University of Toronto cybersecurity organization says Pegasus is using this vulnerability “Since at least February 2021”.

“This feat [l’élément qui permet d’exploiter la faille informatique], which we have named FORCEDENTRY, (…) worked against Apple iOS, MacOS and WatchOS devices ”, the operating systems of mobile phones, computers and smartwatches from the brand to Apple, without even the user having clicked on a link or button trapped.

Article reserved for our subscribers Read also “Project Pegasus”: Revelations on a Global Phone Spy System

“After identifying this flaw (…), Apple quickly developed and deployed a patch in iOS 14.8 to protect our users ”, Ivan Krstic, director of security systems at Apple, told Agence France-Presse (AFP).

The Californian group praised Citizen Lab for its work and pointed out that this type of attack “Ultra-sophisticated”, “Cost millions of dollars, don’t last long and are used to target specific people”. They therefore do not constitute “Not a threat to the overwhelming majority of our users”, said Ivan Krstic.

Increasingly sophisticated threats

Apple’s update, which has made the security of its phones and computers a major selling point, shows the growing difficulty for companies, including the Silicon Valley giants, to cope with growing computer threats. more sophisticated.

Article reserved for our subscribers Read also Sold as very safe, iPhones have been hacked by Pegasus for years

“In the past, users could be trained to avoid infection by watching out for suspicious text messages and not clicking on links to numbers they didn’t know.”, says Kevin Dunne, president of Pathlock, a cybersecurity company. “But now attackers arrive, without any click, to access all the data of a phone, its microphone and its camera, through the vulnerabilities of third-party applications or even present by default”, he said.

Data theft and ransomware attacks have increased in recent months, targeting various businesses and organizations, including an American pipeline operator and a major Indian airline. But NSO-related spy hacks are unique in that they come from legal authorities or agencies, using software provided by a company, and not from anonymous criminals.

“NSO will continue to equip intelligence and law enforcement agencies around the world with technologies that save lives and help fight crime and terrorism.”, reacted on its side the Israeli company.

Article reserved for our subscribers Read also Pegasus spyware and the weaknesses of Europeans

“Buy your own NSA”

Citizen Lab had played a key role in bringing the mass spy scandal to light via Pegasus in July. According to information revealed by a consortium of international media including The world, in France, an issue of Emmanuel Macron, former Prime Minister Edouard Philippe and fourteen members of the government figured “In the list of numbers selected by a security service of the Moroccan State, user of the spyware Pegasus, for a potential piracy”.

Read also “Project Pegasus”: Israel assures France to take the matter “seriously”, Paris awaits “clarifications”

In all, according to Amnesty International and Forbidden Stories, the case concerns a list of 50,000 phone numbers around the world selected since 2016 by NSO customers.

Pegasus allows “To buy your own NSA”, the American intelligence agency, in July Ron Deibert, the director of Citizen Lab, quipped.

“Selling these technologies to governments who will use them in violation of international law and human rights ultimately facilitates the discovery of this software by research organizations, as we and others have shown on multiple occasions. It was still the case this time “, the laboratory said on Monday.

Last March, the American think tank Atlantic Council had already sounded the alarm on the dangerous role played by NSO and other companies specializing in the sale of intrusion tools in smartphones and other computer systems.

These experts and politicians like German Chancellor Angela Merkel have called for more restrictions on the sale of this type of software, operated by states but not only.

Read also: How Israeli company NSO Group revolutionized espionage

The World with AFP