Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

New iOS Zero-Click Exploit Defeats Apple ‘BlastDoor’ Sandbox

Security researchers at Citizen Lab are documenting a new Apple iOS zero-click exploit being used to hijack data from fully patched iPhones in Bahrain.

Citizen Lab said it found technical evidence connecting the new exploit to the Pegasus high-end spyware tool sold by controversial Israeli software vendor NSO Group.

Security researchers at Citizen Lab are documenting a new Apple iOS zero-click exploit being used to hijack data from fully patched iPhones in Bahrain.

Citizen Lab said it found technical evidence connecting the new exploit to the Pegasus high-end spyware tool sold by controversial Israeli software vendor NSO Group.

The appearance of a new zero-click iMessage exploit comes just eight months after Apple silently added a new, tightly sandboxed “BlastDoor” service into iOS to specifically parse untrusted data in iMessages to block zero-click exploitation.

In a detailed report documenting the findings, Citizen Lab named the new exploit FORCEDENTRY and confirmed it was capable of defeating the BlastDoor sandbox.

Once confirmed by Apple, this will be the 61st documented zero-day vulnerability exploited in the wild so far in 2021.  Security defects in Apple’s code are responsible for 14 in-the-wild zero-day exploits this year.

[ READ: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks ]  

Citizen Lab, which is connected to the University of Toronto, said the FORCEDENTRY exploit was used to plant the Pegasus malware on the iPhones of nine Bahrani human rights activists between June 2020 and February 2021.

Citizen Lab said crash logs from infected iPhones show the existence of two separate iMessage zero-click exploits — KISMET aimed at iOS 13.5.1 devices, and FORCEDENTRY targeting the newest iOS 14 devices.

Advertisement. Scroll to continue reading.

“We saw the FORCEDENTRY exploit successfully deployed against iOS versions 14.4 and 14.6 as a zero-day,” Citizen Lab said.

The report documents the cat-and-mouse game being played as Apple struggles to lock down its devices from these types of attacks that do not require the victim clicking or interacting with any content.

[ Read: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits ]

“At least four of the activists were hacked by LULU, a Pegasus operator that we attribute with high confidence to the government of Bahrain, a well-known abuser of spyware,” Citizen Lab said in a report that identifies bloggers, political dissidents, and activists among the victims.

“One of the activists was hacked in 2020 several hours after they revealed during an interview that their phone was hacked with Pegasus in 2019,” the group said.

Citizen Lab said it shared crash logs and some additional phone logs relating to KISMET and FORCEDENTRY with Apple, a suggestion that an out-of-band emergency iOS update may be distributed soon.

Related: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks

Related: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits

Related: Apple Ships Emergency Fixes for Under-Attack iOS Zero-Day

Related: Apple Patches ‘Actively Exploited’ Mac, iOS Security Flaw

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Understand how to go beyond effectively communicating new security strategies and recommendations.

Register

Join us for an in depth exploration of the critical nature of software and vendor supply chain security issues with a focus on understanding how attacks against identity infrastructure come with major cascading effects.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

Vulnerabilities

A researcher at IOActive discovered that home security systems from SimpliSafe are plagued by a vulnerability that allows tech savvy burglars to remotely disable...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Cybercrime

Patch Tuesday: Microsoft calls attention to a series of zero-day remote code execution attacks hitting its Office productivity suite.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.