Apple has rushed out a patch for its mobile operating system, iOS, after malware—reportedly developed by an Israeli firm that sells spying software to governments—was able to remotely surveil an up-to-date iPhone 6.
The attack attempts to encourage users to open a URL via text message. When that link is followed, the attack uses three individual zero-day flaws to leverage a weakness in Safari’s browser engine, which enables access to the operating system’s kernel and installation of malware to effectively jailbreak the iPhone. From that point on, the malware can be used to spy on virtually every aspect of the phone’s use, from phone calls and text messages to calendar data and video feeds.
This appears to be the first known example of hackers having the ability to remotely jailbreak an iPhone 6, and Motherboard claims that it’s the first iPhone attack of this kind. The vulnerability was identified by researchers at the University of Toronto's Citizen Lab after Ahmed Mansoor, a human rights activist and United Arab Emirates dissident, was targeted using the attack.
The Citizen Lab team claims that the malware was developed by the Israeli firm NSO Group, which creates spy software for governments. It’s no secret that NSO makes software capable of surveilling smartphones: in 2014, the Wall Street Journal reported that an NSO slide claimed to provide technology that “allows remote and stealth monitoring and full data extraction from remote devices via untraceable commands.” It’s currently unclear who exactly used the malware to target Mansoor.
Reuters suggests that such a piece of software, able to spy on an up-to-date iPhone 6, could retail for as much as $1 million.
Citizen Lab researchers informed Apple of the vulnerability over a week ago, and the iPhone maker has released a patch for devices running iOS 9. Apple claims devices running up-to-date beta versions of iOS 10 are unaffected.
Apple recently announced a bug-bounty program, which will see it pay out up to $200,000 for (invited) hackers who manage to identify the kinds of flaws leveraged by this malware. Perhaps it should’ve started sooner.
The big new idea for making self-driving cars that can go anywhere
The mainstream approach to driverless cars is slow and difficult. These startups think going all-in on AI will get there faster.
Inside Charm Industrial’s big bet on corn stalks for carbon removal
The startup used plant matter and bio-oil to sequester thousands of tons of carbon. The question now is how reliable, scalable, and economical this approach will prove.
The dark secret behind those cute AI-generated animal images
Google Brain has revealed its own image-making AI, called Imagen. But don't expect to see anything that isn't wholesome.
The hype around DeepMind’s new AI model misses what’s actually cool about it
Some worry that the chatter about these tools is doing the whole field a disservice.
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.