Hello world,
Just months after Apple unveiled a brand new security system meant to protect iMessage
from hacks - new iMessage hacks have been observed being weaponised by none other than
Pegasus spyware to target people governments don't like.
That’s in today’s episode of the weak web where we break down and dissect cyber
security related tech news. New iPhone hacks, in particular iMessage vulnerabilities
have been observed being exploited by Pegasus, the infamous spyware sold by NSO group - an
Israeli company which makes incredibly advanced hacking tools. This comes merely months after
Apple announced ‘Blast Door’ - a brand new iOS security system that was meant to
prevent the exact type of exploit used in this campaign. It’s not much surprise that
the victims here are political activists and human rights campaigners, hacked via a mere
text message. This new hacking crusade is a super interesting story, it illustrates
the apparent dismal futility of defending against exploits of this nature.
These new findings come courtesy of Citizenlab - a university run research group, Citizenlab
is pointing the finger at “LULU” - a codename they’ve given to a Pegasus spyware operator
which has been attributed with high confidence to be the Bahraini government, allegedly an
NSO customer since 2017. NSO claims only to provide their spyware to aid in legitimate
efforts such as “prevent[ing] terror attacks”. However in the case of Bahrain it’s no shock
that these tools seem to have been used for other purposes, Bahrain has a vivid history
of oppressing dissidents, with citizenlab describing “long pattern of arrests, torture,
and aggressive silencing of political opposition.” Political parties are banned in Bahrain, and
just to put into perspective how toxic the political culture is, here’s a billboard
from 2011, literally calling on the government to hang political activists. Y’know maybe
selling op hacking tools to these guys isn’t the best of ideas.
The new report confirms this. In total 9 activists had their iPhones hacked via exploits in iMessage.
Pegasus spyware has a long history of using 1 click exploits, in which a victim receives
a text - often disguised as a parcel tracking notification, socially engineering the target
into clicking a dodgy link. Once clicked, a vulnerability is exploited, installing Pegasus
spyware onto the device, silently. However in this case, the reality is more insidious.
The exploit - which citizenlab have dubbed “FORCEDENTRY” is a zero click exploit,
meaning a victim needs only to receive a dodgy message to become pwned, no social engineering
required. This type of vulnerability is the “Crème de la crème” of hacks, as you’re
pretty much guaranteed to infect the victim as long as they’re running a version of
iOS which is exploitable. “FORCEDENTRY” takes advantage of how images are transcoded
in iMessages’ backend. If you’re after a full technical explanation I’ll link citizenlab’s
full report in the description.
Once installed Pegasus has de facto unfettered access to a device, it can read messages,
listen to your microphone, peep through the camera, and so on. The perfect spying tool.
You may be wondering how hacks like this are even discovered, citizenlab explains how they
identify people at risk from government spying, and “set up VPNs, for key targets to monitor
their Internet traffic.” - essentially logging all traffic in and out of an activist’s
phone so in the event an intrusion is suspected, citizenlab can later “analyze the phone
logs using [their] forensic process,”.
Vulnerabilities in iMessage are nothing new. Apple, wanting to plug the problem, earlier
this year released a brand new security mechanism called “Blast Door”. “Blast Door”
acts as a sandbox for all incoming communications through iMessage. With “Blast Door” messages
are decompressed and parsed in a sectioned off area, supposedly restricting access malicious
messages would otherwise have to things like file system interactions, network access etcetera.
The researcher who first discovered “Blast Door” said at the time it “should have
a significant impact on the security of iMessage and the platform as a whole.” and that “It’s
great to see Apple putting aside the resources for these kinds of large refactorings to improve
end users’ security.” And from what I’ve seen it’s not so easy to garner praise from
security peeps, “Blast Door” was released to critical acclaim as a pretty good defence
system for iMessage. However… it obviously wasn’t good enough - as “FORCEDENTRY”
was observed cutting through it like butter - just 1 month after “Blast Door” went
live
Let’s not forget, NSO has hundreds of very smart and, I imagine, very highly paid engineers
working around the clock to identify security holes in iOS and Android. If there’s a vulnerability
in our mobile devices, there’s a good chance NSO will be the ones to find it - package
it up in a fancy product and sell it to dubious governments to aid in quote on quote “counter
terrorism”.
Despite the existence of such pervasive spyware, the evidence shows us that unless you piss
off an authoritarian regime you are probably, probably safe from Pegasus. However if you
are rather partial to getting on the nerves of autocrats, heck - if I keep on making these
videos I might have to start worrying - if you are worried, there is one easy thing you
can do, Citizenlab says they “believe that the specific attacks [they] mention in this
report could have been prevented by disabling iMessage and FaceTime.” Each messaging App
you use is a potential door into your device, so simply reducing the number of doors will
reduce your risk. NSO is known to target iMessage and WhatsApp, so ditching these and switching
to something more privacy and security oriented is a good bet.
NSO has kind of responded to these new allegations, I can’t find any update to the statement
they gave a few days ago in which they said they “had not yet seen the report”. But
added “If NSO receives reliable information related to the misuse of the system, the company
will vigorously investigate the claims and act accordingly,”. However, NSO doesn’t
respond well to criticism. A month or so ago, when their previous scandal was breaking they
put out a blog post titled “ENOUGH IS ENOUGH!” in all caps. In which they basically explained
that they were rage quitting from talking to the media, “announcing it will no longer
be responding to media inquiries on this matter. They also reiterated that their mission with
Pegasus is “saving lives, helping governments around the world prevent terror attacks, breaking
up pedo gangs,”, etc, etc.
And so the saga continues, the cat and mouse game of patching vulnerabilities, only for
new ones to appear, and fall foul to exploitation will never be over.
I need to tell you about today’s sponsor Linode! VPNs are useful, and aim to keep you
private and secure, but they come with a trove of issues. Mainly, would you entrust a VPN
company with your traffic over your ISP? The bottom line is that if you didn't set up the
VPN server yourself, you really can't be sure that these VPN companies won't keep logs,
sell your data, or monitor your traffic. That's why I’ve teamed up with Linode to give you
the opportunity to host your own private VPN for free. Linode is a totally customisable
cloud hosting platform with a whole host of server apps you can install with one click.
Using their wireguard or openVPN apps you can spin up a private VPN controlled wholly
by yourself in a matter of minutes.
Linode launched way back in 2003, that’s 3 years before AWS was even a thing, Linode
doesn’t spend a second on side hustles like grocery chains or reading you bedtime stories,
cloud computing is what they do best, and is their only focus. Linode is offering all
of you guys $100 in free credit just for signing up, use your $100 to instantiate your private
VPN or literally anything else cloud computing related. They have 24/7 phone support (which
is a godsend in the world of servers) so you’ll never be left out in the cold.
Go to linode.com/seytonic or click the link in the description to claim your free $100.
If you enjoy this kind of video make sure to help me out by tickling the like button
for the youtube AI as well as turning on those sub notifications. If you’re looking for
something to watch next go check out my previous video on the FBI’s terrorist watch list,
colloquially known as the no fly list being leaked on publicly visible servers for the
world to see.
As always sources will be linked in the video description, make sure to follow me on the
instagrams for behind the scene footage, stay tuned for more hacking videos, have a good
one.