A zero-click iMessage exploit by Apple was employed to implant spyware on iPhones.

A zero-click iMessage exploit by Apple was employed to implant spyware on iPhones.

A recent incident involving Apple's iMessage has come to light, revealing a zero-click exploit that was used to infect iPhones with spyware. Citizen Lab, a security research group, has reported that two previously unknown vulnerabilities, which have since been fixed by Apple through emergency updates, were exploited as part of a zero-click exploit chain called "BLASTPASS." This exploit chain was employed to deploy NSO Group's Pegasus spyware on iPhones that were already up to date with the latest patches.

These two vulnerabilities were identified as CVE-2023-41064 and CVE-2023-41061. They allowed attackers to compromise fully patched iPhones running iOS 16.6, particularly targeting a civil society organization based in Washington DC. The attack was carried out through PassKit attachments containing malicious images, sent from the attacker's iMessage account to the victim, requiring no interaction from the victim.

Citizen Lab emphasized the severity of this exploit, urging Apple users to update their devices immediately. Additionally, they recommended activating Lockdown Mode, especially for those individuals who might be at risk of targeted attacks based on their identity or profession.

Apple and Citizen Lab's security researchers discovered these zero-days in the Image I/O and Wallet frameworks. CVE-2023-41064 involved a buffer overflow triggered when processing maliciously crafted images, while CVE-2023-41061 was a validation issue exploitable through malicious attachments. Both vulnerabilities allowed threat actors to execute arbitrary code on iPhones and iPads that hadn't received patches.

To address these flaws, Apple released updates for macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2. A range of Apple devices were affected, including iPhone 8 and later, various iPad models, Macs running macOS Ventura, and Apple Watch Series 4 and later.

This incident marked the latest in a series of zero-days that Apple has addressed in 2023, emphasizing the ongoing need for vigilance and prompt updates to protect against emerging threats. These vulnerabilities have been discovered and patched across different Apple operating systems throughout the year.