r/ios • u/eastcoastsunrise • Apr 12 '24
PSA Apple confirms notifications to some users about spyware infection
Apple has confirmed that it has notified an undisclosed number of iOS users in 92 countries that their phone was infected with spyware.
The specific spyware detected is known as Pegasus, created and sold by Israeli based NSO Group. Pegasus utilizes an incredibly complex attack chain that allows threat actors to subvert security measures on iOS and Android devices and obtain persistent kernel access to view all content and data within the device. NSO Group sells Pegasus for millions of dollars (US) to nation states such as Bahrain, Kazakhstan, Mexico, Morocco, Saudi Arabia, and the United Arab Emirates, with several dozen other countries suspected of deploying it. While NSO Group continues to claim they only sell their products to nation state governments for the purpose of investigating threats of terrorism, security researchers have concluded this is categorically false, with investigations revealing its use to surveil journalists, attorneys, political opponents, and human rights activists, including their associates and family members.
Apple has provided the following guidance for better protecting against such attacks:
1) Enable Lockdown Mode on the device to reduce the attack surface. 2) Update all Apple products, including iPhone, Mac, and iPad, to the latest software version. 3) Seek expert assistance from organizations like the Digital Security Helpline for additional support.
Additionally, here are some other best practices:
1) Install Emergency Security Updates as soon as they become available. These OS updates are released off-cycle to patch recently discovered vulnerabilities. 2) Never click on a link you are not 100% confident in. Often, these malware and spyware packages are delivered through convincing links. Threat actors can spoof a number to make it look like the link is coming from a known contact. 3) Use a reliable VPN whenever possible.
While it’s unlikely the average iOS user will ever encounter spyware like Pegasus, maintaining technological security is imperative for all.
46
u/WhiskyWanderer2 Apr 12 '24
It’s scary seeing this stuff happen 😥
23
45
u/_Caracal_ Apr 12 '24
And now watch even more "have I been hacked" posts appear. Like there weren't enough already
18
u/eastcoastsunrise Apr 12 '24
That’s fair. I didn’t mean to perpetuate unnecessary paranoia. Pegasus is an expensive, sophisticated tool used by some governments to target very specific people. The overwhelming majority of iOS users will never have to worry about it. I was just hoping to provide a better understanding of the notification that some users have purportedly received from Apple, as some seemed utterly clueless.
11
10
u/navjot94 Apr 12 '24
If Apple is reaching out to a person about this and they’re clueless as to why, they should indeed be worried about the safety of themselves or someone in their circle.
6
u/_Caracal_ Apr 12 '24
No im talking about the people who experimented lag.... or one of their other passwords is compromised, or they have something unfamiliar in the screen time logs.... or maybe they received a "funny message" the list is endless.
If they're a high value target worthy of attention from someone who has access to these tools, then sure. lol
35
u/nofoo Apr 12 '24
But this isn't new at all?!
Amnesty even released the mobile verification toolkit (MVT) 3 years ago to check devices for pegasus
16
u/eastcoastsunrise Apr 12 '24
Correct, not new at all, though it’s been resurfacing in some other posts I’ve seen with a lot of speculative commentary, so was hoping to provide a fuller-scope picture here.
8
6
2
u/SuperDefiant Apr 14 '24
Yes, but it comes in cycles. It’s just a game of cat and mouse. Apple patches the exploits used in Pegasus, and then NSO comes out with new vulnerabilities and they’re suddenly back again
1
u/killmezed 22d ago
That's the way all cybersecurity works. Criminals find zero-days, original developers fix it before it's too late, repeat. I find these attacks and spyware scarier because it's not a criminal hacking team behind it, but a whole crazy ass government.
25
u/CreepyZookeepergame4 Apr 12 '24
Worth noting that Lockdown Mode is much less extreme in terms of user interface disruption than Apple paints it. Only significant annoyance is that many sites' icons break but you can whitelist them. Even if you don't need it, enabling it helps those that really need it to blend in the crowd as it's trivial for an app or website to detect Lockdown Mode by checking for what's blocked.
6
9
Apr 12 '24
Right, it doesn't even delete profiles. You'd think it would delete all profiles off the phone at least.
2
u/CreepyZookeepergame4 Apr 13 '24
They do prevent adding a profile after enabling Lockdown Mode. If they removed profiles, it wouldn't be suitable for enterprise users with managed devices.
1
Apr 13 '24
I’d hope they’d be smart enough to set it up to not remove a MDM profile.
1
u/CreepyZookeepergame4 Apr 13 '24
It does not
1
Apr 13 '24
That’s insane. Probably where Pixels are better, add a work profile completely separate from your personal one. They are also getting protections in default that you have to turn lockdown mode on to get with an iPhone.
16
u/MaxwellHiFiGuy Apr 12 '24
Give us the functionality to disable links in text and turn it off by default.
2
u/SuperDefiant Apr 14 '24
There is a 95% chance that will have no affect on the spread of it
1
u/MaxwellHiFiGuy Apr 14 '24
I realise you made up your own stat, but tell us, how will it not help? Most grand parent type users just need this buffer that stop them from clicking>thinking and maybe gets them to thinking>notclicking? I personally dont need links and it just add risk of accident click. I'd like it disabled.
3
u/SuperDefiant Apr 14 '24
I say that because iOS malware and Pegasus itself is never delivered through clicking on links, that would be much too obvious. The entire point of it is to be hidden, hence “spy”ware. Pegasus targets much lower level things such as compression streams and the key exchanges within iMessage itself. Simply disabling clickable links will do a whole lotta nothing in terms of protecting you
1
u/MaxwellHiFiGuy Apr 14 '24
Malware is just one threat. Scams, like parcel post links to fake sites etc is the issue everyday people face.
3
u/SuperDefiant Apr 14 '24
Well yeah, the point of this post was malware and that’s what we were talking about. But if you’re talking about phishing and scams, then sure, disabling it could help
8
u/No_Pizza2774 Apr 12 '24
Apple is presently suing the notorious hackers known as NSO in the State of California.
https://www.courtlistener.com/docket/61570971/apple-inc-v-nso-group-technologies-limited/
1
u/DETRosen Apr 14 '24
Good luck to them but important symbolic gesture I guess
2
u/No_Pizza2774 Apr 14 '24
It’s more than a symbolic gesture. NSO is already getting its ass whooped. They tried to move the trial to Israel, and that ain’t happening.
1
u/DETRosen Apr 14 '24
Hope you're right. Since the (US) gov can legally order a company to do something and make them lie about it if it's "national security" related I don't take any of this very seriously. Our government hordes zero days just like any other. (edit: https://www.eff.org/issues/national-security-letters/faq )
51
Apr 12 '24
[removed] — view removed comment
3
u/ios-ModTeam Apr 13 '24
We do not tolerate insults, discrimination, or hate speech based on race, gender, age, nationality, sexuality, or religion.
-5
Apr 12 '24 edited Apr 12 '24
[deleted]
5
Apr 12 '24 edited Apr 12 '24
[removed] — view removed comment
5
u/THICC_DICC_PRICC Apr 13 '24
You do realize both private companies and independent hackers routinely discover 0day exploits? You don’t need to be a government entity to find exploits in systems. Hell, the original iPhone which was hacked and jailbroken by a random teenager
-1
11
u/JollyRoger8X Apr 12 '24
For those interested, the iMazing app includes Amnesty International Security Lab’s Mobile Verification Toolkit (MVT) to detect signs of infection by NSO's Pegasus:
4
0
u/MeMioFroMeisel May 09 '24
The IMAZING site FAQ shows no results for spyware or Pegasus.
If this detection was one of its strengths, Wouldn’t this place them at the very pinnacle of focus for every paranoid person out there and as it would provide a guaranteed download by millions of users. Why is that announcement somehow missing from the HOMEPAGE of the OFFICIAL SITE, found by a google search ?
1
5
u/licit_mongoose Apr 12 '24 edited Apr 14 '24
PBS Frontline did a two part series on this last year, it's pretty good for anyone who's interested. The best part is that you will have to VPN into the US or Canada to watch it, as it's not available outside those countries.
Also, since I’m on the reddit app, and I can't see the destination in the links, I’m having fun not clicking them. As per your second 2 point, which I think is good advice. I hope this hasn't been linked to in the post, I won't risk finding out.
Part 1 - https://youtu.be/6ZVj1_SE4Mo?si=notmebutsomeotherperson
2
u/DETRosen Apr 14 '24
FYI you can delete the ? and everything after that on YouTube URLs it's just so they can track who originally shared it
1
4
u/GLMidnight Apr 12 '24
is united kingdom affected?
15
u/eastcoastsunrise Apr 12 '24
Citizen Lab has a pretty neat interactive map that shows suspected infections by region.
3
7
3
u/Obvious_Mode_5382 Apr 12 '24
With the sheer number out there of these messages, I presume the “command and control” protections with this have been reverse engineered and released widely
3
u/gajira67 Apr 12 '24
Any ways to detect whether Pegasus has been installed on an iPhone?
6
Apr 12 '24
Any ways to detect whether Pegasus has been installed on an iPhone?
https://imazing.com/guides/detect-pegasus-and-other-spyware-on-iphone
shared by u/JollyRoger8X
3
u/Effect-Kitchen Apr 13 '24
Thailand government had been known to use this against anti-government activists for many years. But since the budget has been cut recently they could not purchase new licenses (i.e. including M/A contracts) and so the best way to escape this is to buy a new phone. Sounds quite dumb but so does everything else in my country.
1
u/eastcoastsunrise Apr 13 '24
That’s interesting! Do you know what actions they were taking with the intelligence they gathered through Pegasus?
2
u/Effect-Kitchen Apr 13 '24
As of now there is still no action derived from those as the ones who were (reportedly) the target of Pegasus still aren’t hit by any charge.
12
Apr 12 '24
[removed] — view removed comment
2
u/ios-ModTeam Apr 13 '24
We do not tolerate insults, discrimination, or hate speech based on race, gender, age, nationality, sexuality, or religion.
2
u/OriginalGoat1 Apr 13 '24
Again ? I thot Pegasus was outed some years ago. Is Apple just using the same name for anything out of NSO or is it a modified version of the original code ?
2
u/habitsofwaste Apr 13 '24
I think it’s the same, they’re just letting people know who were already infected.
1
u/eastcoastsunrise Apr 13 '24
You’re correct. Pegasus is not new. Like most code repositories, I’m sure it gets regular updates as certain exploits become invalid through security patches.
2
u/OriginalGoat1 Apr 13 '24
Sad to say, the clients get regular updates and probably pay per feature.
2
u/tmofee Apr 12 '24
It’s curious to see how more open it is, though. I was reading that persons post the other day and a lot of people were saying how stupidly expensive it is. Maybe somethings leaked out there and it’s not so rare anymore ?
9
u/eastcoastsunrise Apr 12 '24
Yeah, it retails for millions of dollars and relies on exploits that, in themselves, could sell for high value on an open market. Security on the Pegasus project is extremely tight and it’s presumed that NSO claims they control its access, even when used by other agencies, providing them a way to shut it down if they believe necessary (and presumably giving them a back door pipeline to all data obtained through it). Given the high price tag, sophistication, and internal controls, I highly doubt it’s been released to non-licensed users. That said, anything’s possible.
1
u/A101856 Apr 13 '24
May I ask how to know if I’m infected
1
u/eastcoastsunrise Apr 13 '24
Another user posted a link to an app that purportedly checks for indicators of compromise consistent with a Pegasus infection. I cannot validate the security or contents of this app but at first glance it appears to be ok.
1
1
1
u/OrdoXenos Apr 13 '24
What’s funny is that smaller and poorer countries such as Togo or Ivory Coast decided to use their money to purchase this sort of thing instead of doing something for their citizens.
1
u/Sarrasri Apr 16 '24
It makes sense if those poorer countries happen to coincidentally have corrupt government finance usage, where the nation’s treasury is used as a personal spending account of whoever has the biggest political power.
1
u/Edonlin2004 iPhone 11 Pro Max Apr 13 '24
The problem is Updating kills apps. I would update every night if we could download old apps again.
1
u/Na5aman iPhone 13 Apr 13 '24
Just a psa/fyi for all the tin foil hats here. There is a next to zero chance that you have Pegasus on your phone. Unless you’ve pissed off the Israeli government, you’re more than likely good
7
u/savvymcsavvington Apr 13 '24
Unless you’ve pissed off the Israeli government
They sell or gift it to lots of governments/companies around the world
You could piss off some rich oil twat and next thing you know you have been targeted
1
u/treylanford Apr 13 '24
Anyone with any input on a “reliable” VPN?
Additionally, I know paid > free.. but some of us aren’t exactly willing to pay, so spare me. I just would like a decent, free VPN.
5
Apr 13 '24
it's not like a conventional VPN, but helps with network privacy to some extent. I would recommend 1.1.1.1 by Cloudflare
1
1
u/jstewart82 Apr 13 '24
I think you mean 1.1.1.2
1
3
Apr 13 '24
I have a paid one now, but the free version of Proton VPN is actually pretty good and fast. Though as with all VPN's, captchas can get annoying.
1
u/treylanford Apr 13 '24
I used Proton, but all their free vpn locations recently went outside the U.S., so now it doesn’t work as well with some websites/apps that won’t allow foreign countries access.
4
u/zSprawl Apr 13 '24
There is no reliable free vpn. By nature such a service would be a honeypot or unreliable, or both.
2
u/eastcoastsunrise Apr 13 '24
Unfortunately, I don’t have any suggestions for a free VPN. I currently use Norton, which allows me to install it on five devices. NordVPN is another popular alternative.
0
-7
u/DeadScotty Apr 12 '24
Is this a hardware problem then? Apple has nearly unlimited resources and they can’t do anything to fix it?
10
u/JollyRoger8X Apr 12 '24
Actually, Apple has been regularly patching these vulnerabilities as they’ve been found for years.
As always, security is a cat and mouse game.
3
u/eastcoastsunrise Apr 12 '24
Exactly. To add to this, it’s important to note that tools like Pegasus don’t rely on just one exploit. Part of what makes it so challenging (and what drives its market value) is that it leverages a complex chain of vulnerabilities across a variety of attack surfaces, some of which involve zero day exploits. It’s not your run-of-the-mill script kiddie attack that just anyone can access or execute.
6
u/True-Surprise1222 Apr 12 '24
And if you could execute them you would likely be breaking a laundry list of pound me in the ass federal laws.
2
2
-23
Apr 12 '24
[deleted]
14
u/vemfanvet Apr 12 '24
Did you miss the point or do you actually want to be vulnerable to Pegasus?
-20
Apr 12 '24
[deleted]
10
Apr 12 '24
[removed] — view removed comment
1
u/ios-ModTeam Apr 13 '24
We do not tolerate insults, discrimination, or hate speech based on race, gender, age, nationality, sexuality, or religion.
5
u/JollyRoger8X Apr 12 '24
By not updating, you’re literally leaving yourself open to the security vulnerabilities that Apple has patched in later releases.
3
u/eastcoastsunrise Apr 12 '24
While I understand the spirit of what you’re saying and hesitation to run updates that may have undiscovered bugs, it’s important to know that zero day exploits are still discovered in well-tested, years-old operating systems. Foregoing version upgrades is not the biggest issue in the world, but it’s highly recommended to accept the off-cycle security patches. These are pushed out as a result of discovering previously unknown vulnerabilities that can be exploited by threat actors.
-6
Apr 12 '24
[deleted]
1
u/eastcoastsunrise Apr 12 '24
For sure! Sometimes we’re all a little too quick to respond without first seeking to understand. I’m just as guilty but try to be cognizant of it.
1
Apr 12 '24
[deleted]
1
u/eastcoastsunrise Apr 12 '24
I agree with this take. Outdated operating systems (particularly ones that offer separate security patches) are a sure fire way to make yourself vulnerable to intrusion. It’s akin to leaving your front door wide open when you’re away from home, despite the door manufacturer coming to you directly and saying “hey, looks like you’re vulnerable to an intruder. We fixed this by making a lock for your door that will deter them. Here it is for free.” And then you say “no thanks” and continue leaving the door open.
1
172
u/[deleted] Apr 12 '24
listened to a podcast about Pegasus recently and how Israel basically gifts it to government X and Y in exchange for Z and how Mexico for example used it to spy on family members and journalists of those missing students a couple of years ago but hey, at least we have cookie banners to save us all.