www.bleepingcomputer.com
Open in
urlscan Pro
104.20.60.209
Public Scan
URL:
https://www.bleepingcomputer.com/news/apple/apple-fixes-ios-zero-day-used-to-deploy-nso-iphone-spyware/
Submission: On September 14 via api from US — Scanned from DE
Submission: On September 14 via api from US — Scanned from DE
Form analysis 6 forms found in the DOM
https://www.bleepingcomputer.com/search/
<form title="Search site" action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>https://www.bleepingcomputer.com/search/
<form action="https://www.bleepingcomputer.com/search/">
<input type="hidden" name="cx" value="partner-pub-0920899300397823:3529943228">
<input type="hidden" name="cof" value="FORID:10">
<input type="hidden" name="ie" value="UTF-8">
<input type="search" name="q" aria-label="Search Site" placeholder="Search Site">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" name="EMAIL" aria-label="Enter email address" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST //bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e
<form action="//bleepingcomputer.us10.list-manage.com/subscribe/post?u=3e2b3b692f780cdff40d45346&id=30c98e654e" method="post" target="_blank" novalidate="">
<input type="email" aria-label="Enter email address" name="EMAIL" placeholder="Email Address...">
<div style="position: absolute; left: -5000px;"><input type="hidden" aria-hidden="true" name="b_3e2b3b692f780cdff40d45346_30c98e654e" tabindex="-1" value=""></div>
<input type="submit" value="Submit" class="bc_sub_btn">
</form>POST https://www.bleepingcomputer.com/forums/index.php?app=core&module=global§ion=login&do=process&return=https://www.bleepingcomputer.com/news/apple/apple-fixes-ios-zero-day-used-to-deploy-nso-iphone-spyware/
<form action="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&do=process&return=https://www.bleepingcomputer.com/news/apple/apple-fixes-ios-zero-day-used-to-deploy-nso-iphone-spyware/"
method="post">
<div class="bc_form_feild">
<label for="ips_username">Username</label>
<input aria-label="Enter login name" title="Enter login name" type="text" id="ips_username" name="ips_username" autocomplete="username">
</div>
<div class="bc_form_feild">
<label for="ips_password">Password</label>
<input aria-label="Enter login password" title="Enter login passwod" type="password" id="ips_password" name="ips_password" autocomplete="current-password">
</div>
<div class="bc_form_feild">
<div class="bc_remember">
<input id="remember" type="checkbox" name="rememberMe" value="1" checked="checked">
<label for="remember">Remember Me</label>
</div>
<div class="bc_anon">
<input id="anonymous" type="checkbox" name="anonymous" value="1">
<label for="anonymous">Sign in anonymously</label>
</div>
</div>
<div class="bc_btn_wrap">
<input type="hidden" name="auth_key" value="880ea6a14ea49e853634fbdc5015a024">
<input type="submit" aria-label="Login to site" title="Login" value="Login" class="bc_sub_btn">
<a aria-label="Sign in with Twitter" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=login&serviceClick=twitter&return=https://www.bleepingcomputer.com/news/apple/apple-fixes-ios-zero-day-used-to-deploy-nso-iphone-spyware/" class="bc_twitter_btn"><img src="https://www.bleepstatic.com/images/site/login/twitter.png" width="28" height="24" alt="Sign in with Twitter button"> Sign in with Twitter</a>
<hr>
<p>Not a member yet? <a aria-label="Register account" title="Register account" href="https://www.bleepingcomputer.com/forums/index.php?app=core&module=global&section=register">Register Now</a></p>
</div>
</form><form>
<input type="hidden" id="comment-id-report" value="0">
<ul>
<li>
<label><input type="radio" name="comment-report-reason" value="Spam">Spam</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Abusive or Harmful">Abusive or Harmful</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Inappropriate content">Inappropriate content</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Strong language">Strong language</label>
</li>
<li>
<label><input type="radio" name="comment-report-reason" value="Other">Other</label>
</li>
<li id="comment-report-other-reason-wrap" style="display:none;">
<textarea aria-label="Enter other reason for reporting the comment" rows="2" cols="2" id="comment-report-other-reason"></textarea>
</li>
</ul>
<p>Read our <a href="https://www.bleepingcomputer.com/posting-guidelines/">posting guidelinese</a> to learn what content is prohibited.</p>
</form>Text Content
WE VALUE YOUR PRIVACY
We and our partners store and/or access information on a device, such as cookies
and process personal data, such as unique identifiers and standard information
sent by a device for personalised ads and content, ad and content measurement,
and audience insights, as well as to develop and improve products.
With your permission we and our partners may use precise geolocation data and
identification through device scanning. You may click to consent to our and our
partners’ processing as described above. Alternatively you may access more
detailed information and change your preferences before consenting or to refuse
consenting. Please note that some processing of your personal data may not
require your consent, but you have a right to object to such processing. Your
preferences will apply to this website only. You can change your preferences at
any time by returning to this site or visit our privacy policy.
MORE OPTIONSAGREE
*
*
*
*
*
*
* News
* Featured
* Latest
* Apple fixes iOS zero-day used to deploy NSO iPhone spyware
* BlackMatter ransomware hits medical technology giant Olympus
* Firefox now bypasses Windows 11's messy default browser settings
* Windows 11 Android support spotted online ahead of launch
* Google patches 10th Chrome zero-day exploited in the wild this year
* This bundle helps you explore the exciting world of machine learning
* Firefox now bypasses Windows 11's messy default browser settings
* Apple fixes iOS zero-day used to deploy NSO iPhone spyware
* Downloads
* Latest
* Most Downloaded
* Qualys BrowserCheck
* STOPDecrypter
* AuroraDecrypter
* FilesLockerDecrypter
* AdwCleaner
* ComboFix
* RKill
* Junkware Removal Tool
* Virus Removal Guides
* Latest
* Most Viewed
* Ransomware
* How to remove the PBlock+ adware browser extension
* Remove the Toksearches.xyz Search Redirect
* Remove the Smashapps.net Search Redirect
* Remove the Smashappsearch.com Search Redirect
* Remove Security Tool and SecurityTool (Uninstall Guide)
* How to remove Antivirus 2009 (Uninstall Instructions)
* How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
* How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using
TDSSKiller
* Locky Ransomware Information, Help Guide, and FAQ
* CryptoLocker Ransomware Information Guide and FAQ
* CryptorBit and HowDecrypt Information Guide and FAQ
* CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
* Tutorials
* Latest
* Popular
* How to make the Start menu full screen in Windows 10
* How to install the Microsoft Visual C++ 2015 Runtime
* How to open an elevated PowerShell Admin prompt in Windows 10
* How to Translate a Web Page in Google Chrome
* How to start Windows in Safe Mode
* How to remove a Trojan, Virus, Worm, or other Malware
* How to show hidden files in Windows 7
* How to see hidden files in Windows
* Deals
* Categories
* eLearning
* IT Certification Courses
* Gear + Gadgets
* Security
* Forums
* More
* Startup Database
* Uninstall Database
* File Database
* Glossary
* Chat on Discord
* Send us a Tip!
* Welcome Guide
* Home
* News
* Apple
* Apple fixes iOS zero-day used to deploy NSO iPhone spyware
*
*
APPLE FIXES IOS ZERO-DAY USED TO DEPLOY NSO IPHONE SPYWARE
By
LAWRENCE ABRAMS
* September 13, 2021
* 03:10 PM
* 0
Apple has released security updates to fix two zero-day vulnerabilities that
have been seen exploited in the wild to attack iPhones and Macs. One is known to
be used to install the Pegasus spyware on iPhones.
The vulnerabilities are tracked as CVE-2021-30860 and CVE-2021-30858, and both
allow maliciously crafted documents to execute commands when opened on
vulnerable devices.
The CVE-2021-30860 CoreGraphics vulnerability is an integer overflow bug
discovered by Citizen Lab that allows threat actors to create malicious PDF
documents that execute commands when opened in iOS and macOS.
PLAY Video Settings Full Screen About Connatix V129302 1/1 Skip Ad Continue
watching after the ad Visit Advertiser website GO TO PAGE
CVE-2021-30858 is a WebKit use after free vulnerability allowing hackers to
create maliciously crafted web page that execute commands when visiting them on
iPhones and macOS. Apple states that this vulnerability was disclosed
anonymously.
"Apple is aware of a report that this issue may have been actively exploited,"
the company said in security advisories published today regarding both
vulnerabilities.
While Apple did not release any further information on how the vulnerabilities
were used in attacks, Citizen Lab has confirmed that CVE-2021-30860 is a
zero-day zero-click iMessage exploit named 'FORCEDENTRY.'
The FORCEDENTRY exploit was discovered to be used to bypass the iOS BlastDoor
security feature to deploy the NSO Pegasus spyware on devices belonging to
Bahraini activists.
BleepingComputer has contacted Citizen Lab with further questions about the
attacks but has not heard back at this time.
APPLE ZERO-DAYS RUN RAMPANT IN 2021
It has been a very busy year for Apple with what seems like an unending
streaming of zero-day vulnerabilities used in targeted attacks against iOS and
Mac devices.
* The FORCEDENTRY exploit disclosed in August (previously tracked by Amnesty
Tech as Megalodon),
* three iOS zero-days (CVE-2021-1870, CVE-2021-1871, CVE-2021-1872) in
February, exploited in the wild and reported by anonymous researchers,
* an iOS zero-day (CVE-2021-1879) in March that may have also been actively
exploited,
* one zero-day in iOS (CVE-2021-30661) and one in macOS (CVE-2021-30657) in
April, exploited by Shlayer malware,
* three other iOS zero-days (CVE-2021-30663, CVE-2021-30665, and
CVE-2021-30666) in May, bugs allowing for arbitrary remote code execution
(RCE) simply by visiting malicious websites,
* a macOS zero-day (CVE-2021-30713) in May, which was abused by the XCSSET
malware to bypass Apple's TCC privacy protections.
* two iOS zero-day bugs (CVE-2021-30761 and CVE-2021-30762) in June that "may
have been actively exploited" to hack into older iPhone, iPad, and iPod
devices.
Project Zero also disclosed 11 zero-day vulnerabilities this year that were used
in attacks targeting Windows, iOS , and Android devices.
Update 9/13/21: Added confirmed from Citizen Labs that this update fixes the
FORCEDENTRY vulnerability.
RELATED ARTICLES:
Apple fixes zero-day affecting iPhones and Macs, exploited in the wild
New zero-click iPhone exploit used to deploy NSO spyware
Apple fixes bug that breaks iPhone WiFi when joining rogue hotspots
Apple fixes three zero-days, one abused by XCSSET macOS malware
Google: Russian SVR hackers targeted LinkedIn users with Safari zero-day
* Apple
* CVE-2021-30858
* CVE-2021-30860
* iOS
* Mac
* macOS
* Pegasus Spyware
* Vulnerability
* Zero-Day
* Facebook
* Twitter
* LinkedIn
* Email
*
LAWRENCE ABRAMS
Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com.
Lawrence's area of expertise includes malware removal and computer forensics.
Lawrence Abrams is a co-author of the Winternals Defragmentation, Recovery, and
Administration Field Guide and the technical editor for Rootkits for Dummies.
* Previous Article
* Next Article
POST A COMMENT COMMUNITY RULES
YOU NEED TO LOGIN IN ORDER TO POST A COMMENT
Not a member yet? Register Now
YOU MAY ALSO LIKE:
Popular Stories
* Windows MSHTML zero-day exploits shared on hacking forums
* BlackMatter ransomware hits medical technology giant Olympus
NEWSLETTER SIGN UP
To receive periodic updates and news from BleepingComputer, please use the form
below.
NEWSLETTER SIGN UP
* Follow us:
*
*
*
*
MAIN SECTIONS
* News
* Downloads
* Virus Removal Guides
* Tutorials
* Startup Database
* Uninstall Database
* File Database
* Glossary
COMMUNITY
* Forums
* Forum Rules
* Chat
USEFUL RESOURCES
* Welcome Guide
* Sitemap
COMPANY
* About BleepingComputer
* Contact Us
* Send us a Tip!
* Advertising
* Write for BleepingComputer
* Social & Feeds
* Changelog
Terms of Use - Privacy Policy - Ethics Statement
Copyright @ 2003 - 2021 Bleeping Computer® LLC - All Rights Reserved
LOGIN
Username
Password
Remember Me
Sign in anonymously
Sign in with Twitter
--------------------------------------------------------------------------------
Not a member yet? Register Now
REPORTER
HELP US UNDERSTAND THE PROBLEM. WHAT IS GOING ON WITH THIS COMMENT?
* Spam
* Abusive or Harmful
* Inappropriate content
* Strong language
* Other
*
Read our posting guidelinese to learn what content is prohibited.
Submitting...
SUBMIT