Apple Releases Patch After Discovery of Three Zero-Day Vulnerabilities

Apple has released a patch for a trio of zero-day exploits that were used to target the iPhone 6 of UAE-based human rights activist Ahmed Mansoor. According to security reports, a text message was sent to Mansoor, baiting him with secrets about detainees being mistreated in UAE jails and urging him to click an included link. Apprehensive of the message, Mansoor contacted watchdog group Citizen Lab, who in turn confirmed that it was an attempted cyberattack. The human rights activist has previously been a target of two other spyware tools.

Citizen Lab collaborated with security firm Lookout to dig deeper, and together they found a chain of zero-day vulnerabilities, dubbed ‘Trident’, that would have hijacked Mansoor’s phone and allowed the installation of more compromising malware.

According to the ensuing investigation, ‘Trident’ is used in a spyware called Pegasus which is a product from NSO Group Technologies Ltd., a cyberwarfare-focused company that works with homeland security and military organizations.

The attack sequence used by Pegasus follows the classic phishing pattern: send SMS, victim clicks link that loads compromised web site, vulnerabilities are exploited, and more spy software is installed. Pegasus is known to be capable of accessing messaging apps, social media accounts, email accounts, call logs, the device microphone, camera and others—all done in the background, leaving the user unaware of any irregular activity.

Lookout and Citizen Lab worked with Apple on the patch before the vulnerability was disclosed. 

iOS 9.3.5: The fix is out

All Apple users should update to the latest version of iOS immediately. On iOS devices, the update can be installed by going to Settings>General>Software Update. Hit Download, and then Install.

The iOS platform, coupled with Apple's walled garden approach to software installations, has been known to be relatively harder to crack, but incidents have proven that it's not impossible. Mobile users should be more discriminating about the links they click, and verify that they came from legitimate sources.