Israeliska NSO Groups spyware Pegasus kan användas för att exploatera en eller flera buggar i Apples Messages, i iOS 14.6, den senaste versionen.

Enligt Amnestys säkerhetslabb, Amnesty Tech, som analyserat förmodat hackade telefoner så finns det tecken som tyder på att Pegasus kan installeras med en så kallad ”No-Click” funktion. Det vill säga att Pegasus kan installeras utan att användaren måste klicka eller göra något aktivt. Detta via Apples inbyggda meddelandeprogram Messages.

Massive data leak reveals over 50,000 phone numbers of potential surveillance targets for clients of spyware company NSO.

These include heads of state, activists and journalists, including Jamal Khashoggi’s family.https://t.co/V8yUnPwCjx

— Amnesty Tech (@AmnestyTech) July 18, 2021

Buggar

Uppgifterna från Amnesty bekräftas av Citizen Lab vilket innebär att det finns en eller flera synnerligen allvarliga buggar i iOS 14.6 och i iPadOS 14.6.

It also indicates that Apple has a MAJOR blinking red five-alarm-fire problem with iMessage security that their BlastDoor Framework (introduced in iOS 14 to make zero-click exploitation more difficult) ain't solving.

— Bill Marczak (@billmarczak) July 18, 2021

NSO har tillbakavisat alla uppgifter:

NSO does not operate the systems that it sells to vetted government customers, and does not have access to the data of its customers’ targets. NSO does not operate its technology, does not collect, nor possesses, nor has any access to any kind of data of its customers. Due to contractual and national security considerations, NSO cannot confirm or deny the identity of our government customers, as well as identity of customers of which we have shut down systems.

The Guardian

Apple har ännu inte kommenterat uppgifterna.