iPhones vulnerable to hacking tool for months, researchers say

For almost a year, spyware sold by Israel’s NSO Group was allegedly armed with a computer security super-weapon: a zero-footprint, zero-click, zero-day exploit that used a vulnerability in iMessage to seize control of an iPhone at the push of a button.

That means it would have left no visible trace of being placed on target’s phones, could be installed by simply sending a message that the victim didn’t even need to click on, and worked even on phones that were running the then-latest version of iOS, the operating system for iPhones.

Researchers at the University of Toronto’s Citizen Lab said they discovered the alleged hacking tool, which has been dubbed “Kismet”. If Kismet can be thought of as the Trojan horse, used to bypass the security of an iPhone, then the soldiers inside are another piece of software sold by the NSO Group, called Pegasus, and it is frighteningly powerful, according to claims by Citizen Lab.

“We believe that (at a minimum) this version of the Pegasus spyware had the capability to track location, access passwords and stored credentials on the phone, record audio from the microphone including both ambient ‘hot mic’ recording and audio of encrypted phone calls, and take pictures via the phone’s camera.”

Citizen Lab said that it had found 37 known examples of Kismet being used by NSO clients against journalists covering news in and around the Middle East. But, the researchers said, “given the global reach of NSO Group’s customer base, the apparent vulnerability of almost all iPhone devices prior to the iOS 14 update, we suspect that the infections that we observed were a minuscule fraction of the total attacks used with this exploit”.

In a statement, an Apple spokesperson said: “At Apple, our teams work tirelessly to strengthen the security of our users’ data and devices. iOS 14 is a major leap forward in security and delivered new protections against these kinds of attacks. The attack described in the research was highly targeted by nation states against specific individuals. We always urge customers to download the latest version of the software to protect themselves and their data.”

Although the first alleged attacks using Kismet were this summer, Citizen Lab claimed that logs from compromised phones suggested the same technique, or a related zero-click zero-day exploit, was used as far back as October 2019.

Citizen Labs’ allegations, which Apple said it had been unable to independently verify, suggest the discovery of the most serious hacking effort targeting iOS users since an unrelated widespread campaign was shut down in February 2019.

That campaign, discovered by Google engineers and disclosed last August, used a security flaw in how iPhones visit websites to steal private data like iMessages, photos and GPS location in real time. In a public statement, Apple sought to downplay that attack by noting that it “affected fewer than a dozen websites that focus on content related to the Uighur community”. The company made a similar point about Kismet, noting that the NSO Group’s customers are nation states, and its targets are a limited number of individuals.

Apple has sought to make privacy and security major selling points for its devices. The company prides itself on not harvesting user data for commercial purposes, and makes a point of noting that there has never been any widespread malware in the history of the iPhone. As far back as 2014, the Apple CEO, Tim Cook, was attacking Google’s Android on stage at his company’s worldwide developers’ conference by noting that the platform “dominates” the mobile malware market, calling it a “toxic hellstew of vulnerabilities”.

But in recent years, the gap between Apple and its competitors has closed. And as more security researchers have focused on mobile devices, embarrassing vulnerabilities have been discovered.

Earlier this month, another Google researcher, Ian Beer, disclosed a ferocious “zero-click zero-day” iOS vulnerability that allowed him to take total control of an iPhone simply by being in wifi range of the device. That flaw was fixed by Apple in iOS 13.5.

NSO Group said its products are for tackling “serious organised crime and counter-terrorism” and any evidence of a serious breach of its policies would be investigated. It added: “As we have repeatedly stated, we do not have access to any information with respect to the identities of individuals our system is used to conduct surveillance on.”