New iOS Zero-Click Exploit Defeats Apple ‘BlastDoor’ Sandbox

Security researchers at Citizen Lab are documenting a new Apple iOS zero-click exploit being used to hijack data from fully patched iPhones in Bahrain.

Citizen Lab said it found technical evidence connecting the new exploit to the Pegasus high-end spyware tool sold by controversial Israeli software vendor NSO Group.

The appearance of a new zero-click iMessage exploit comes just eight months after Apple silently added a new, tightly sandboxed “BlastDoor” service into iOS to specifically parse untrusted data in iMessages to block zero-click exploitation.

In a detailed report documenting the findings, Citizen Lab named the new exploit FORCEDENTRY and confirmed it was capable of defeating the BlastDoor sandbox.

Once confirmed by Apple, this will be the 61st documented zero-day vulnerability exploited in the wild so far in 2021.  Security defects in Apple’s code are responsible for 14 in-the-wild zero-day exploits this year.

[ READ: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks ]  

Citizen Lab, which is connected to the University of Toronto, said the FORCEDENTRY exploit was used to plant the Pegasus malware on the iPhones of nine Bahrani human rights activists between June 2020 and February 2021.

Citizen Lab said crash logs from infected iPhones show the existence of two separate iMessage zero-click exploits — KISMET aimed at iOS 13.5.1 devices, and FORCEDENTRY targeting the newest iOS 14 devices.

“We saw the FORCEDENTRY exploit successfully deployed against iOS versions 14.4 and 14.6 as a zero-day,” Citizen Lab said.

The report documents the cat-and-mouse game being played as Apple struggles to lock down its devices from these types of attacks that do not require the victim clicking or interacting with any content.

[ Read: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits ]

“At least four of the activists were hacked by LULU, a Pegasus operator that we attribute with high confidence to the government of Bahrain, a well-known abuser of spyware,” Citizen Lab said in a report that identifies bloggers, political dissidents, and activists among the victims.

“One of the activists was hacked in 2020 several hours after they revealed during an interview that their phone was hacked with Pegasus in 2019,” the group said.

Citizen Lab said it shared crash logs and some additional phone logs relating to KISMET and FORCEDENTRY with Apple, a suggestion that an out-of-band emergency iOS update may be distributed soon.

Related: Apple Adds ‘BlastDoor’ to Secure iPhones From Zero-Click Attacks

Related: Secretive Israeli Exploit Company Behind Wave of Zero-Day Exploits

Related: Apple Ships Emergency Fixes for Under-Attack iOS Zero-Day

Related: Apple Patches ‘Actively Exploited’ Mac, iOS Security Flaw