Apple issues emergency patch for exploited iOS zero-days

Apple has issued iOS version 9.3.5 to plug three vulnerabilities researchers say were used to attack New York Times journalists and to track down activists and dissidents.

The vulnerabilities are in the iOS kernel and in the WebKit rendering engine, and can cause memory disclosure and corruption. Together, they could be used to execute arbitrary code with elevated system privileges. 

Security vendor Lookout, which has been working with researchers from the University of Toronto’s Citizen Lab, has linked the three vulnerabilities it dubbed ‘Trident’ to commercial spyware called Pegasus.

Pegasus is developed by an American-owned NSO Group in Israel, which specialises in zero-days, obfuscation, encryption and kernel level exploitation.

Pegasus delivers Trident in a multi-stage attack, Lookout said.

“The attack sequence, boiled down, is a classic phishing scheme: send text message, open web browser, load page, exploit vulnerabilities, install persistent software to gather information.

This, however, “happens invisibly and silently, such that victims do not know they’ve been compromised,” Lookout and Citizen Lab researchers wrote.

Once a device is compromised, attackers are able to access messages, voice and video calls, emails, log files and other data from apps including Skype, Gmail, Facebook, Apple FaceTime and Calendar, Viber and others.

Citizen Lab said they found links between NSO Group’s infrastructure and an attack on United Arab Emirates human rights activist Ahmed Mansoor.

Mansoor received text messages promising details on detainees tortured in UAE jails, asking him to click on links.

He instead sent the messages to Citizen Lab researchers, who were able to trace the content back to NSO Group. They worked with Lookout to unearth a chain of zero-day exploits that could have been used to disable iOS security features and install malware and spyware.

Trident is also believed to have been used in attacks against The New York Times and other US media bureaux in Russia. 

The vulnerabilities have also been patched in Apple’s iOS 10 beta, the company told US media.