Security News > 2023 > September > Zero-Click Exploit in iPhones

Zero-Click Exploit in iPhones
2023-09-13 11:13

Citizen Lab says two zero-days fixed by Apple today in emergency security updates were actively abused as part of a zero-click exploit chain to deploy NSO Group's Pegasus commercial spyware onto fully patched iPhones.

The two bugs, tracked as CVE-2023-41064 and CVE-2023-41061, allowed the attackers to infect a fully-patched iPhone running iOS 16.6 and belonging to a Washington DC-based civil society organization via PassKit attachments containing malicious images.

"We refer to the exploit chain as BLASTPASS. The exploit chain was capable of compromising iPhones running the latest version of iOS without any interaction from the victim," Citizen Lab said.

"The exploit involved PassKit attachments containing malicious images sent from an attacker iMessage account to the victim."


News URL

https://www.schneier.com/blog/archives/2023/09/zero-click-exploit-in-iphones.html

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2023-09-07 CVE-2023-41064 Classic Buffer Overflow vulnerability in Apple Ipados and Iphone OS
A buffer overflow issue was addressed with improved memory handling.
local
low complexity
apple CWE-120
7.8
2023-09-07 CVE-2023-41061 Unspecified vulnerability in Apple Ipados
A validation issue was addressed with improved logic.
local
low complexity
apple
7.8