Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

New iOS Zero-Click Exploit Defeats Apple ‘BlastDoor’ Sandbox

Security researchers at Citizen Lab are documenting a new Apple iOS zero-click exploit being used to hijack data from fully patched iPhones in Bahrain.

Citizen Lab said it found technical evidence connecting the new exploit to the Pegasus high-end spyware tool sold by controversial Israeli software vendor NSO Group.

Security researchers at Citizen Lab are documenting a new Apple iOS zero-click exploit being used to hijack data from fully patched iPhones in Bahrain.

Citizen Lab said it found technical evidence connecting the new exploit to the Pegasus high-end spyware tool sold by controversial Israeli software vendor NSO Group.

The appearance of a new zero-click iMessage exploit comes just eight months after Apple silently added a new, tightly sandboxed “BlastDoor” service into iOS to specifically parse untrusted data in iMessages to block zero-click exploitation.

In a detailed report documenting the findings, Citizen Lab named the new exploit FORCEDENTRY and confirmed it was capable of defeating the BlastDoor sandbox.

Once confirmed by Apple, this will be the 61st documented zero-day vulnerability exploited in the wild so far in 2021.  Security defects in Apple’s code are responsible for 14 in-the-wild zero-day exploits this year.

[ READ: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks ]  

Citizen Lab, which is connected to the University of Toronto, said the FORCEDENTRY exploit was used to plant the Pegasus malware on the iPhones of nine Bahrani human rights activists between June 2020 and February 2021.

Citizen Lab said crash logs from infected iPhones show the existence of two separate iMessage zero-click exploits — KISMET aimed at iOS 13.5.1 devices, and FORCEDENTRY targeting the newest iOS 14 devices.

Advertisement. Scroll to continue reading.

“We saw the FORCEDENTRY exploit successfully deployed against iOS versions 14.4 and 14.6 as a zero-day,” Citizen Lab said.

The report documents the cat-and-mouse game being played as Apple struggles to lock down its devices from these types of attacks that do not require the victim clicking or interacting with any content.

[ Read: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits ]

“At least four of the activists were hacked by LULU, a Pegasus operator that we attribute with high confidence to the government of Bahrain, a well-known abuser of spyware,” Citizen Lab said in a report that identifies bloggers, political dissidents, and activists among the victims.

“One of the activists was hacked in 2020 several hours after they revealed during an interview that their phone was hacked with Pegasus in 2019,” the group said.

Citizen Lab said it shared crash logs and some additional phone logs relating to KISMET and FORCEDENTRY with Apple, a suggestion that an out-of-band emergency iOS update may be distributed soon.

Related: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks

Related: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits

Related: Apple Ships Emergency Fixes for Under-Attack iOS Zero-Day

Related: Apple Patches ‘Actively Exploited’ Mac, iOS Security Flaw

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.

Register

People on the Move

After the passing of Amit Yoran, Tenable has appointed Steve Vintz and Mark Thurmond as co-CEOs.

Former Wiz executive Trish Cagliostro has joined Orchid Security as Chief Revenue Officer.

Transcend has named former UnitedHealth Group CISO Aimee Cardwell as CISO in Residence.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.