Thursday, July 18, 2024

Apple Fixes iMessage Zero-Click Bug That Used to Deploy NSO Pegasus Spyware

Recently, Apple has published a security update for iPhone, iPad, Mac, and Apple Watch, in which it addresses a number of zero-day vulnerabilities, and also one of which was utilized to bypass OS defenses.

The company reinforced CVE-2021-30858 in WebKit, a post-release exploit vulnerability that enables remote code execution while processing all kinds of malicious web content. 

On the other hand, there is a second vulnerability “CVE-2021-30860” that affects the CoreGraphics element and it can be used to remotely administer code while preparing a malicious PDF document.

Previous NSO Zero-Click Exploits

According to the report list, FORCEDENTRY is one of the latest in a string of zero-click exploits that were linked to NSO Group. Moreover, in the year 2019, WhatsApp has eventually fixed CVE-2019-3568, a zero-click vulnerability in WhatsApp calling that NSO Group applied against more than 1400 phones in a time period of two-week.

However, in 2020, NSO Group hired the KISMET zero-click iMessage exploit, but it was claimed that KISMET vulnerability was never recognized, though we assume that the underlying vulnerability can no longer be exploited through iMessage.


The cybersecurity researchers have pronounced some payload of this vulnerability:-

  • There were 27 copies of the same file with the “.gif” extension. And after the investigation, it came to know that the file is a 748-byte Adobe PSD file. And every file created an IMTranscoderAgent crash on the device. 
  • It also consists of four different files including the “.gif” extension that were the Adobe PDF files including a JBIG2-encoded stream. And among them, Two files has 34-character names, and two had 97-character names.
  • Lastly, the output of the pdfid tool on these four “.gif” files was NB: the stream had a different length.


In total there are two vulnerabilities were detected by the security experts of CISA and here they are mentioned below:-

Discovery and Disclosure

After investigating the vulnerability, the analysts asserted that they have found that the format of the files has matched with two types of crashes. 

It was observed by the experts on another phone, and while observing it got hacked with Pegasus, and they suspected that the “.gif” files might contain parts of FORCEDENTRY exploit chain.

Here, the security researchers have named the FORCEDENTRY exploit CVE-2021-30860, and define it as processing a maliciously crafted PDF that might lead to arbitrary code execution.

Attribution to NSO Group

On proper investigation, they identified and affirmed that they have noted various distinctive elements that enabled them to make a high-confidence attribution to NSO Group:-

  • Initially, the spyware installed by the FORCEDENTRY exploits presented a forensic artifact that was named CASCADEFAIL. It is a bug and all the evidence of it has incompletely been deleted from the phone’s data usage.sqlite file. 
  • Moreover, the spyware installed by the FORCEDENTRY exploits practiced different process names, which also include the name “setframed”. However, this particular process name was practiced in an initiative with NSO Group’s Pegasus spyware on an Al Jazeera reporter in July 2020. 

CISA’s Recommendation

While apart from this, the security analysts at CISA encourages users and administrators to immediately check and apply the newly released security updates for the following products:-

Moreover, they are trying their best to circumvent this kind of attack, but the actual chain of exploitation begins when the victim accepts a text message with a malicious GIF image. 

During an investigation, it has been cleared that this file is really Adobe PSD and PDF documents that create the automatic rendering element to malfunction and affect the device with the Pegasus malware.

Follow us on LinkedinTwitterFacebook for daily Cybersecurity News & Updates


Latest articles

Volcano Demon Group Attacking Organizations With LukaLocker Ransomware

The Volcano Demon group has been discovered spreading a new ransomware called LukaLocker, which...

Resonance Security Launches Harmony to Monitor and Detect Threats to Web2 and Web3 Apps

Quick take:Harmony is the fourth cybersecurity application Resonance developed to address the disconnect in...

Beware! of New Phishing Tactics Mimic as HR Attacking Employees

Phishing attacks are becoming increasingly sophisticated, and the latest strategy targeting employees highlights this...

MirrorFace Attacking Organizations Exploiting Vulnerabilities In Internet-Facing Assets

MirrorFace threat actors have been targeting media, political organizations, and academic institutions since 2022,...

HardBit Ransomware Using Passphrase Protection To Evade Detection

In 2022, HardBit Ransomware emerged as version 4.0. Unlike typical ransomware groups, this ransomware...

New Poco RAT Weaponizing 7zip Files Using Google Drive

The hackers weaponize 7zip files to pass through security measures and deliver malware effectively.These...

New ShadowRoot Ransomware Attacking Business Via Weaponized PDF’s

X-Labs identified basic ransomware targeting Turkish businesses, delivered via PDF attachments in suspicious emails...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles