CISA warns govt agencies to secure iPhones against spyware attacks

2 weeks ago

Apple

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered national agencies coming to spot information vulnerabilities abused arsenic portion of a zero-click iMessage utilization concatenation to infect iPhones pinch NSO Group's Pegasus spyware.

This informing comes aft Citizen Lab disclosed that nan 2 flaws were utilized to discuss fully-patched iPhones belonging to a Washington DC-based civilian nine statement utilizing an utilization concatenation named BLASTPASS that worked via PassKit attachments containing malicious images.

Citizen Lab besides warned Apple customers to use emergency updates issued connected Thursday instantly and urged individuals susceptible to targeted attacks owed to their personality aliases business to alteration Lockdown Mode.

"Apple is alert of a study that this rumor whitethorn person been actively exploited," nan institution said erstwhile describing nan 2 Image I/O and Wallet vulnerabilities, tracked arsenic CVE-2023-41064 and CVE-2023-41061.

The database of impacted devices is rather extensive, arsenic nan bugs impact some older and newer models, and it includes:

iPhone 8 and later
iPad Pro (all models), iPad Air 3rd procreation and later, iPad 5th procreation and later, and iPad mini 5th procreation and later
Macs moving macOS Ventura
Apple Watch Series 4 and later

Apple fixed nan 2 zero-days successful macOS Ventura 13.5.2, iOS 16.6.1, iPadOS 16.6.1, and watchOS 9.6.2 pinch representation handling and improved logic. Both let attackers to summation arbitrary codification execution connected unpatched devices.

BLASTPASS exploits

October 2nd spot deadline

On Monday, CISA added nan 2 information flaws to its Known Exploited Vulnerabilities catalog, tagging them arsenic "frequent onslaught vectors for malicious cyber actors" and posing "significant risks to nan national enterprise."

U.S. Federal Civilian Executive Branch Agencies (FCEB) must spot each vulnerabilities added to CISA's KEV catalog wrong a constricted timeframe, per a binding operational directive (BOD 22-01) published successful November 2022.

After today's update, national agencies must unafraid each susceptible iOS, iPadOS, and macOS devices connected their networks against CVE-2023-41064 and CVE-2023-41061 by October 2nd, 2023.

While BOD 22-01 chiefly focuses connected U.S. national agencies, CISA besides powerfully advised backstage companies to prioritize patching nan 2 vulnerabilities arsenic soon arsenic possible.

Since January 2023, Apple fixed a full of 13 zero-days exploited to target iOS, macOS, iPadOS, and watchOS devices, including:

two zero-days (CVE-2023-37450 and CVE-2023-38606) successful July
three zero-days (CVE-2023-32434, CVE-2023-32435, and CVE-2023-32439) successful June
three much zero-days (CVE-2023-32409, CVE-2023-28204, and CVE-2023-32373) successful May
two zero-days (CVE-2023-28206 and CVE-2023-28205) successful April
and a WebKit zero-day (CVE-2023-23529) successful February