Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

New iOS Zero-Click Exploit Defeats Apple ‘BlastDoor’ Sandbox

Security researchers at Citizen Lab are documenting a new Apple iOS zero-click exploit being used to hijack data from fully patched iPhones in Bahrain.

Citizen Lab said it found technical evidence connecting the new exploit to the Pegasus high-end spyware tool sold by controversial Israeli software vendor NSO Group.

Security researchers at Citizen Lab are documenting a new Apple iOS zero-click exploit being used to hijack data from fully patched iPhones in Bahrain.

Citizen Lab said it found technical evidence connecting the new exploit to the Pegasus high-end spyware tool sold by controversial Israeli software vendor NSO Group.

The appearance of a new zero-click iMessage exploit comes just eight months after Apple silently added a new, tightly sandboxed “BlastDoor” service into iOS to specifically parse untrusted data in iMessages to block zero-click exploitation.

In a detailed report documenting the findings, Citizen Lab named the new exploit FORCEDENTRY and confirmed it was capable of defeating the BlastDoor sandbox.

Once confirmed by Apple, this will be the 61st documented zero-day vulnerability exploited in the wild so far in 2021.  Security defects in Apple’s code are responsible for 14 in-the-wild zero-day exploits this year.

[ READ: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks ]  

Citizen Lab, which is connected to the University of Toronto, said the FORCEDENTRY exploit was used to plant the Pegasus malware on the iPhones of nine Bahrani human rights activists between June 2020 and February 2021.

Citizen Lab said crash logs from infected iPhones show the existence of two separate iMessage zero-click exploits — KISMET aimed at iOS 13.5.1 devices, and FORCEDENTRY targeting the newest iOS 14 devices.

“We saw the FORCEDENTRY exploit successfully deployed against iOS versions 14.4 and 14.6 as a zero-day,” Citizen Lab said.

The report documents the cat-and-mouse game being played as Apple struggles to lock down its devices from these types of attacks that do not require the victim clicking or interacting with any content.

[ Read: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits ]

“At least four of the activists were hacked by LULU, a Pegasus operator that we attribute with high confidence to the government of Bahrain, a well-known abuser of spyware,” Citizen Lab said in a report that identifies bloggers, political dissidents, and activists among the victims.

“One of the activists was hacked in 2020 several hours after they revealed during an interview that their phone was hacked with Pegasus in 2019,” the group said.

Citizen Lab said it shared crash logs and some additional phone logs relating to KISMET and FORCEDENTRY with Apple, a suggestion that an out-of-band emergency iOS update may be distributed soon.

Related: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks

Related: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits

Related: Apple Ships Emergency Fixes for Under-Attack iOS Zero-Day

Related: Apple Patches ‘Actively Exploited’ Mac, iOS Security Flaw

Written By

Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

Vulnerabilities

GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet