AN urgent warning has been issued to stop using Apple iMessage and update devices with the latest iOS after the Pegasus spyware hack.
It comes as Apple issued an emergency software update following a huge security breach that allowed iPhones to be hacked without any user action.
The malicious spyware, known as Pegasus, was designed by Israeli tech firm NSO Group and could film users through their camera, listen to calls, and could even send messages.
Pegasus is known to have targeted both Apple and Android devices and can avoid detection by antivirus software.
It has been around since 2016 but a leak in July brought it back into the public spotlight.
And now, Apple users are encouraged to download the latest software iOS 14.8 as developers tried to fix the bug.
Forbes' cybersecurity expert Zak Doffman has warned of the negatives that come with using iMessage and insisted he can "no longer recommend iMessage as a daily messenger for Apple users."
Instead, he recommends two apps: WhatsApp or Signal.
Doffman added: "As the shadow of Pegasus now recedes (Apple hopes), post iOS 14.8 and its welcome (albeit belated) transparency, Apple has serious iMessage questions to address.'
"With iMessage you can send secure texts, but only to other Apple users; with Google Messages, you can now send secure RCS messages from your Android device, but not to iPhones," Doffman explained.
"Crossing platforms (instead of networks, this time around) will see your messages revert to unsecured SMS, and that is best avoided"
John Scott-Railtona, a senior researcher for The Citizen Lab, shared an urgent warning to Twitter last week.
He wrote: "UPDATE YOUR APPLE DEVICES NOW
"We caught a zero-click, zero day iMessage exploit used by NSO Group's #Pegasus spyware. Target? Saudi activist. We reported the #FORCEDENTRY exploit to @Apple, which just pushed an emergency update."
The Citizen Lab's summary of the targeted threat revealed "a zero-day zero-click exploit against iMessage" was discovered during an analysis of the phone of a Saudi activist infected with NSO Group’s Pegasus spyware.
Scott-Railtona explained in follow-up tweets that the bug "exploited Apple’s image rendering library" without the victim knowing.
Victims of the hack are unable to notice the bug because Pegasus gets "silently installed," turning their device into "a spy in their pocket," the senior researcher said.
He added: "Popular chat apps are the soft underbelly of device security.
"They are on every device, & some have a needlessly large attack surface.
"Their security needs to be a *top* priority."
Researchers at the University of Toronto's Citizen Lab said the security vulnerability affected all operating systems under Apple, according to The Associated Press.
The researchers — who discovered the unwanted code on September 7 and immediately contacted Apple — said it was the first time a zero-click exploit had been identified and analyzed.
The Israeli company NSO Group is believed to be behind the attack on a targeted activist who asked to remain anonymous.
Researcher Bill Marczak said: "Were not necessarily attributing this attack to the Saudi government.
"Although Citizen Lab previously found evidence of zero-click exploits being used to hack into the phones of al-Jazeera journalists and other targets, this is the first one where the exploit has been captured so we can find out how it works."
Marczak explains that malicious image files were transferred to the victim's phone through the iMessage instant-messaging app before the device was hacked with NSO’s Pegasus spyware.
The spyware opens a phone to eavesdropping and remote data theft, Marczak said.
According to an Apple blog post, a security update is being issued for iPhones and iPad's after a "maliciously crafted" PDF or web content could result in them getting hacked.
Scott-Railton said this type of hacking shows how necessary it is to keep messaging apps safe.
"Chat apps are increasingly becoming a major way that nation-states and mercenary hackers are gaining access to phones.
"And it’s why it’s so important that companies focus on making sure that they are as locked down as possible."
We pay for your stories!
Do you have a story for The US Sun team?
Email us at [email protected] or call 212 416 4552.
Like us on Facebook at www.facebook.com/TheSunUS and follow us from our main Twitter account at @TheSunUS
Source: Read Full Article
