Apple has just released a series of new updates for iOS, macOS and watchOS to fix a bug that security researchers at Citizen Lab say may have allowed government agencies to install spyware on the phones of journalists, lawyers and activists.
Researchers say the bug allowed a “zero-click” (meaning the target didn’t have to do anything to get infected) installation of the Pegasus spyware, which can reportedly steal data, passwords and activate a phone’s microphone or camera.
Given the severity of the exploit, you should update to iOS 14.8 , macOS Big Sur 11.6 , and watchOS 7.6.2 as soon as possible.
Citizen Lab also said that the vulnerability, which it dubbed “ForcedEntry,” appears to match the behavior of a similar exploit that was made available to Amnesty International in July . At the time, security researchers wrote that the exploit was made possible by a bug in Apple’s CoreGraphics system and occurred when the phone attempted to use a function related to a GIF file after receiving a text message containing a malicious file.
However, even with this information, it could be difficult to determine exactly what happened without access to the infected files themselves. According to Citizen Lab, the suspected files from a hacked activist phone appeared to be GIFs sent as SMS attachments, but were in fact PSD and PDF. Citizen Lab suspected that it could be related to Pegasus, so it sent the files to Apple on September 7. Apple quickly released software updates fixing the bug on September 13 and thanked Citizen Lab in a statement for "completing the very difficult task of obtaining a sample of this exploit."
All of this serves as a reminder of how important it is to keep all your devices up to date. While we hope you will never be on the other side of a government that uses advanced spyware, it is still a good idea to make sure your device is not vulnerable to the widely cited security features.
Dimitris hates Mondays...
