Citizen Lab and the company Lookout Security experts have reported an unprecedented case, and finding unique commercial spyware aimed at iOS. The hardest spyware called Pegasus, developed by the Israeli company NSO Group, was caught while attempting to attack the famous fighter for human rights , Ahmed Mansoor. Malware uses a chain of three once a 0-day vulnerabilities in iOS, dubbed "Trident" and compromised iOS completely , in fact, performing a remote device jailbreak. Apple has already released an emergency patch to fix vulnerabilities found.
Ahmed Mansoor, like many other activists and journalists had already become a target for attacks made with the help of major companies the tools to develop commercial solutions for espionage. So in 2012, he attacked the tools Hacking Team, and before FinFisher. Therefore, when on August 10 by his iPhone 6 came suspicious SMS-messages, Mansoor suspected something and did not click on the links. The message read: "The new secrets of torture Emirates citizens in state prison." Activist sent messages professionals Citizen Lab ( which, in turn, have asked for help from colleagues from the company's Lookout Security), allowing them to study possible malware, situated on the links.
Mansoor suspicions were absolutely justified . Experts Citizen Lab and Lookout Security acknowledged that he had never seen anything like it . It turned out that the spyware, which tries to infect activist , used just three 0-day vulnerability in iOS:
CVE-2016-4657: RCE - vulnerability in the WebKit engine web browser that allows you to remotely execute arbitrary code on the device as soon as the user goes to a specially created website page;
CVE-2016-4655: vulnerability bypasses the Kernel ASLR (KASLR), whereby you can reveal a virtual address in iOS kernel memory;
CVE-2016-4656: LPE - a vulnerability that allows the application to execute arbitrary code with kernel privileges.
This chain of vulnerabilities called Trident. It is said that it is for the 0-day this type of company Zerodium offered a reward of one million dollars: for vulnerabilities that can be remotely jailbreak the device.
" We realized that in front of us is something that no one has ever seen . In the literal sense - click on the link to jailbreaked your iPhone. One of the most difficult cyberspy programs that we have ever met , "- he said vice-president of Lookuot Mike Murray (Mike Murray).
Once researchers understand what they are doing , they immediately got in touch with Apple. Apple Developers took more than ten days to create patches , and today was issued an emergency update to iOS 9.3.5, closing all three vulnerabilities.
"In fact, spyware steals all the information from your phone , intercepting every call and every text message . She steals mail, contacts , the FaceTime calls . It also acts as a backdoor for all communications mechanisms which only have on your phone . Pegasus steals data from the Gmail application , messages with Facebook, all the information from Facebook, all your contacts , absolutely all the data from Skype, WhatsApp, Viber, WeChat, Telegram and so on " , - said Murray.
" This shows what an incredible force possess voices of journalists and activists who provoke the use of this incredibly expensive spyware " - adds John Scott Raylton (John Scott-Railton) from the Citizen Lab.
As it turned out , the creation of Pegasus is based in Israel, the company NSO Group, which Vice President Lookout described as " cyber weapons dealers ." The company was founded in 2010 and since then has been developing legal malware, which sells to governments and intelligence agencies around the world, although the use of NSO Group decision has not been documented by anyone and anywhere. The company works so secretly that never even had its own website and rarely give any comments press. Since this time found it difficult to remain silent , the company issued an official statementin which it said that «NSO 's mission - is to make the world safer by providing authorized governmental entities technologies that help them fight crime and terrorism ."
"Our company works only with authorized government agencies , and in full compliance with stringent legal restrictions on exports and regulation . Moreover, the company does not operate these systems , we are strictly a technology company . The agreement that we sign with the company - customer , requires that the NSO products are used exclusively within the law. Namely , our products can only be used for the prevention and investigation of crimes , "- said representatives of the NSO.
ultratech