Apple Zero Click iMessage Exploit

NSO Group Technologies is an Israeli company well known for its Pegasus zero-click spyware used for surveillance of smartphones.  Pegasus allows a threat actor to gain access to a user’s device via CVE-2021-30860 with no interaction from the user.  Once a device is infected with Pegasus the threat actor can access that user’s messages, emails, photos, calls, microphone, camera and can even read content from encrypted apps such as Signal and WhatsApp.  In the case of the Saudi activist’s phone that was infected with Pegasus, Citizen Labs believes it was exploited using Adobe PSD and PDF files found in the users Library/SMS/Attachments folder on the phone.  Apple has since confirmed the zero-day exploit and describe it as “processing a maliciously crafted PDF may lead to arbitrary code execution” [1].  “The exploit works by exploiting an integer overflow vulnerability in Apple’s image rendering library (CoreGraphics)” [1] according to Citizen Labs.  The research group was able to attribute the attack to the NSO Group because of the incomplete way that Pegasus deletes the evidence from the phone’s DataUsage.sqlite file.  NSO Group’s Pegasus is also known to have been used to hack an Al Jazeera journalist back in July 2020.  It is believed that the vulnerability used in that attack was fixed by Apple using their Blastdoor mitigation in iOS14.  Citizen Labs believes that FORCEDENTRY was developed to get around that fix.