Citizen Lab has identified three zero-click exploits against iOS 15 and 16. These were used by NSO Group’s Pegasus spyware in 2022, and deployed by Mexico against human rights defenders. These vulnerabilities have all been patched.
One interesting bit is that Apple’s Lockdown Mode (part of iOS 16) seems to have worked to prevent infection.
News article.
EDITED TO ADD (4/21): News article. Good Twitter thread.
perry fellwock • April 20, 2023 11:45 AM
Lockdown mode,… Utopia…. Hooray!
Wake up call: code is buggy, especially code that’s ostensibly there to keep you safe. Some bugs are accidental, some are intentional… either way they will be used to gain access. It’s just a matter of time.
It’s like people have forgotten the Snowden era leaks. USA companies are in bed with the intel services. Always have been since the days of Crypto AG and PROMIS
To muddy the water nervous execs put on a show of “resistance” for more gullible members of the public.
Why do you think officials are going nuts about Chinese tech? Because the Chinese are following our example of making tech surveillance friendly.
Don’t ask “is this secure?” Ask “who has access?”
EvilKiru • May 2, 2023 3:10 PM
I guess this is what the recent iOS and MacOS security updates with the “(a)” suffix were released to address.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
TimH • April 20, 2023 9:56 AM
“The first step targets HomeKit, and the second step targets iMessage.”
“the first step targets the iPhone’s Find My feature, and the second step targets iMessage.”
Can Homekit be disabled?
If Find My is disabled, does it still work?
If JS is disabled for Safari (the only place), does it still work?