{"id":22872,"date":"2023-09-08T06:30:08","date_gmt":"2023-09-08T14:30:08","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2023\/09\/08\/news-16602\/"},"modified":"2023-09-08T06:30:08","modified_gmt":"2023-09-08T14:30:08","slug":"news-16602","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2023\/09\/08\/news-16602\/","title":{"rendered":"Message to IT: Update all your Apple devices right away"},"content":{"rendered":"

<\/p>\n

Apple has pushed out an essential security update to defend against yet another attack by an out-of-control mercenary surveillance group<\/a>.<\/p>\n

Like a bad smell, NSO Group has clawed its way back into the spotlight with yet another unprincipled attack<\/a> against free speech and citizens’ rights, as revealed by Citizen Lab<\/a>. The security researchers found this latest example of a sinister, yet egregious zero-click attack while checking the device of an \u201cIndividual employed by a Washington DC-based civil society organization with international offices.\u201d<\/p>\n

This attack, which is being used to deliver NSO Group\u2019s Pegasus mercenary spyware<\/a>, is deeply concerning as it can compromise iPhones running iOS 16.6 without requiring any interaction from the victim. The researchers explained the exploit involved PassKit\u00a0attachments<\/a>\u00a0containing malicious images sent via iMessage. The victim wasn\u2019t even required to look at this image.<\/p>\n

Citizen Lab alerted Apple to the attack and the company swiftly published a security update for all its devices to protect against it. Both companies confirm Lockdown Mode<\/a> will secure devices against such attack.<\/p>\n

Apple published support notes detailing the content of the latest security updates. Warning that these attacks may already be actively exploited, these reveal that \u201cprocessing a maliciously crafted image may lead to arbitrary code execution,\u201d and that this attack was also viable against Wallet.<\/p>\n

\u201cWe would like to acknowledge The Citizen Lab at The University of Toronto\u02bcs Munk School for their assistance,\u201d Apple said.<\/p>\n

\u201cIn this critical time for the future of democracy, the out-of-control mercenary spyware industry is directly undermining our core shared values, security and human rights,\u201d Citizen Labs Senior Researcher John Scott-Railton warned\u00a0the US House Intelligence Committee<\/a>\u00a0last July.<\/p>\n

\u201cOnce more, civil society, is serving as the cybersecurity early warning system for…billions of devices around the world,\u201d he subsequently warned\u00a0on the latest attack<\/a>.<\/p>\n

These attacks are proliferating, the number of companies launching them is increasing, and researchers believe it is inevitable these dangerous exploits will eventually be used by criminals, threatening every aspect of civil society<\/a>.<\/p>\n

There is a security war that must be fought. Apple has already patched 13 actively exploited zero-day vulnerabilities so far this year.\u00a0The time for complacency with Apple security is gone.<\/p>\n

With this in mind, it\u2019s important to adopt a less casual stance to device security.<\/p>\n

The mercenaries who create and profit from these attacks like to claim they only work for legitimate governments. If that\u2019s the case, it is strange that civil society advocates across the planet are regularly being targeted.<\/p>\n

In other words, far from being found in action against a criminal or military target, this particular attack was being made against someone fighting for civil rights in some way. That is not at all reassuring.<\/p>\n

Particularly in light of a recent investigation by the Polish government<\/a>, which found \u201cgross violations of constitutional standards\u201d when the NSO Group\u2019s Pegasus surveillance software was used against opposition leaders. These clearly aren\u2019t the good guys they pretend to be.<\/p>\n

In general, such attacks are described as being more likely to take place against high-value targets, as they can be costly to mount. But it is inevitable that attacks of this kind will proliferate and enter the realm of mainstream digital criminality.<\/p>\n

It is essential this egregious and amoral sham \u201cindustry\u201d is bought to heel<\/a>.<\/p>\n

Please follow me on\u00a0Mastodon<\/a>, or join me in the\u00a0AppleHolic\u2019s bar & grill<\/a>\u00a0and\u00a0<\/em>Apple<\/em>\u00a0Discussions<\/em><\/a>\u00a0groups on MeWe.<\/em><\/p>\n

http:\/\/www.computerworld.com\/category\/security\/index.rss<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

<\/p>\n

\n
\n

Apple has pushed out an essential security update to defend against yet another attack by an out-of-control mercenary surveillance group<\/a>.<\/p>\n

Like a bad smell, NSO Group has clawed its way back into the spotlight with yet another unprincipled attack<\/a> against free speech and citizens’ rights, as revealed by Citizen Lab<\/a>. The security researchers found this latest example of a sinister, yet egregious zero-click attack while checking the device of an \u201cIndividual employed by a Washington DC-based civil society organization with international offices.\u201d<\/p>\n

To read this article in full, please click here<\/a><\/p>\n<\/section>\n<\/article>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_container_layout":"default_layout","colormag_page_sidebar_layout":"default_layout","footnotes":""},"categories":[11062,10643],"tags":[2211,10480,10403,10554,714,24580],"class_list":["post-22872","post","type-post","status-publish","format-standard","hentry","category-computerworld","category-independent","tag-apple","tag-ios","tag-macos","tag-mobile","tag-security","tag-small-and-medium-business"],"_links":{"self":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/22872","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/comments?post=22872"}],"version-history":[{"count":0,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/posts\/22872\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/media?parent=22872"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/categories?post=22872"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.palada.net\/index.php\/wp-json\/wp\/v2\/tags?post=22872"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}