{"id":206567,"date":"2023-09-09T04:03:00","date_gmt":"2023-09-09T04:03:00","guid":{"rendered":"https:\/\/malwaretips.com\/blogs\/?p=206567"},"modified":"2023-09-09T04:03:01","modified_gmt":"2023-09-09T04:03:01","slug":"pegasus-spyware-exploited-two-actively-abused-zero-days-in-fully-patched-iphones","status":"publish","type":"post","link":"https:\/\/malwaretips.com\/blogs\/pegasus-spyware-exploited-two-actively-abused-zero-days-in-fully-patched-iphones\/","title":{"rendered":"Pegasus Spyware Exploited Two Actively Abused Zero-Days in Fully Patched iPhones"},"content":{"rendered":"<p>Apple has released emergency security updates to address two zero-day vulnerabilities that were being actively exploited by NSO Group&#8217;s Pegasus spyware to hack into fully updated iPhones.<\/p><div id=\"mwtad1431462222\" class=\"gas_fallback-ad_309684--placement_360520\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3957935887\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n<p><img decoding=\"async\" class=\"aligncenter  wp-image-206568\" src=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2023\/09\/Exploit-913x1024.jpg\" alt=\"Exploit\" width=\"485\" height=\"544\" title=\"\" srcset=\"https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2023\/09\/Exploit-913x1024.jpg 913w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2023\/09\/Exploit-267x300.jpg 267w, https:\/\/malwaretips.com\/blogs\/wp-content\/uploads\/2023\/09\/Exploit.jpg 974w\" sizes=\"(max-width: 485px) 100vw, 485px\" \/><\/p>\n\n\n<div id=\"mwtad3869383900\" class=\"gas_fallback-ad_309746-ad_309691-placement_360521\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"4456629336\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Pegasus Used BLASTPASS Exploit Chain to Deploy Spyware<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">According to research by <strong><a href=\"https:\/\/citizenlab.ca\/2023\/09\/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild\/\" data-type=\"link\" data-id=\"https:\/\/citizenlab.ca\/2023\/09\/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild\/\" target=\"_blank\" rel=\"noopener\">Citizen Lab<\/a><\/strong>, the two vulnerabilities &#8211; CVE-2023-41064 and CVE-2023-41061 &#8211; were exploited via a zero-click attack chain dubbed BLASTPASS to deploy Pegasus onto iPhones running latest iOS 16.6.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The exploit chain involved sending malicious PassKit attachments containing weaponized image files to victims through iMessage. Once opened, the images triggered the vulnerabilities enabling remote code execution and installation of the Pegasus malware without any user interaction.<\/p><div id=\"mwtad3671820579\" class=\"gas_fallback-ad_381396-ad_309691-placement_360566\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"1471373341\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<div id=\"mwtad2923679347\" class=\"gas_fallback-ad_309747-ad_309691-placement_360587\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"9589536513\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Zero-Days Allowed Complete iPhone Takeover<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Both the flaws resided in core iPhone components &#8211; Image I\/O and Wallet frameworks. CVE-2023-41064 was a buffer overflow triggered during processing of specially crafted images. CVE-2023-41061 stemmed from a validation issue that could be leveraged using malicious attachments.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Together, the vulnerabilities gave attackers full control over targeted devices to extract sensitive data including messages, emails, photos and location history.<\/p>\n\n\n\n<div id=\"mwtad2347996233\" class=\"gas_fallback-ad_309748-ad_309691-placement_360588\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3906789406\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Update iPhones, iPads and Macs Immediately<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Apple has addressed the zero-days in iOS 16.6.1, iPadOS 16.6.1, macOS Ventura 13.5.2, and watchOS 9.6.2 by improving memory handling and input validation.<\/p><div id=\"mwtad2015001593\" class=\"gas_fallback-ad_309686-ad_309691-placement_360569\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"6935453015\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<p class=\"wp-block-paragraph\">Users are strongly advised to install the latest updates on all iPhones, iPads, Macs and Apple Watch models urgently. Those at high risk of spyware attacks should enable Lockdown Mode for additional protection.<\/p>\n\n\n\n<div id=\"mwtad2801109628\" class=\"gas_fallback-ad_318930-ad_309691-placement_360589\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3818335085\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Pegasus Devastating for Journalists, Activists and Dissidents<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pegasus is marketed by NSO Group as a tool for government surveillance of criminals and terrorists. However, it has been consistently misused to hack journalists, human rights activists, lawyers, diplomats and dissidents worldwide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The spyware infects both iPhones and Android devices, enabling unfettered access to messages, emails, calls, photos, location data and even microphone and camera control.<\/p><div id=\"mwtad4068302473\" class=\"gas_fallback-ad_381401-ad_309691-placement_360573\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"5315249587\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>\n\n\n\n<div id=\"mwtad271016261\" class=\"gas_fallback-ad_381388-ad_309691-placement_381390\" style=\"margin-top: 30px;margin-bottom: 30px;\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-7750719144850257\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-7750719144850257\" \ndata-ad-slot=\"3191649120\" \ndata-ad-format=\"auto\" data-full-width-responsive=\"true\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><h2 class=\"wp-block-heading\">Multiple Zero-Days Used in Targeted iPhone Attacks This Year<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Apple has patched 13 zero-days so far in 2023, with many being actively exploited in the wild to compromise up-to-date iPhones and Macs:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>July &#8211; CVE-2023-37450 and CVE-2023-38606<\/li>\n\n\n\n<li>June &#8211; CVE-2023-32434, CVE-2023-32435, CVE-2023-32439<\/li>\n\n\n\n<li>May &#8211; CVE-2023-32409, CVE-2023-28204, CVE-2023-32373<\/li>\n\n\n\n<li>April &#8211; CVE-2023-28206, CVE-2023-28205<\/li>\n\n\n\n<li>February &#8211; CVE-2023-23529<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The growing number of in-the-wild iPhone exploits highlights the need for rapid patching and vigilance, especially for high-risk users.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apple has released emergency security updates to address two zero-day vulnerabilities that were being actively exploited by NSO Group&#8217;s Pegasus spyware to hack into fully updated iPhones. Pegasus Used BLASTPASS Exploit Chain to Deploy Spyware &#8230; <\/p>\n<p class=\"read-more-container\"><a title=\"Pegasus Spyware Exploited Two Actively Abused Zero-Days in Fully Patched iPhones\" class=\"read-more button\" href=\"https:\/\/malwaretips.com\/blogs\/pegasus-spyware-exploited-two-actively-abused-zero-days-in-fully-patched-iphones\/#more-206567\" aria-label=\"Read more about Pegasus Spyware Exploited Two Actively Abused Zero-Days in Fully Patched iPhones\">Read more<\/a><\/p>\n","protected":false},"author":50,"featured_media":206568,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-206567","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guides","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50","resize-featured-image"],"_links":{"self":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/206567","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/comments?post=206567"}],"version-history":[{"count":0,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/posts\/206567\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media\/206568"}],"wp:attachment":[{"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/media?parent=206567"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/categories?post=206567"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/malwaretips.com\/blogs\/wp-json\/wp\/v2\/tags?post=206567"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}