Security researchers explain in an easy-to-understand manner, 'Why is a zero-click attack on the iPhone so dangerous?'
Apple security flaw: How do'zero-click' attacks work? --Digital Journal
https://www.digitaljournal.com/tech-science/apple-security-flaw-how-do-zero-click-attacks-work
◆ Question 1: What is a zero-click attack in the first place?
According to John Scott-Railton, senior researcher at the University of Toronto's Citizen Lab , who discovered a vulnerability in the iPhone, traditional spyware allows the target to click on malicious links or files. It was a mechanism that was installed on smartphones and PCs owned by Citizen Lab.
However, in the zero-click attack, it is said that 'spyware is installed on the terminal even if the user does not access the link'. That's why Scott Railton said, 'Zero-click attacks take the threat of spyware to a new level.'
This update specifically addresses spyware called Pegasus, which allows the target iPhone to be hijacked via Apple's message app, iMessage (denoted as ' message' on Japanese iPhones). ... apparently ...
You can find out what kind of spyware Pegasus is by reading the following articles.
What is 'Pegasus' spyware that monitors celebrities and politicians around the world via iPhone and Android? --GIGAZINE
◆ Question 2: How do I notice an infection on my device?
According to Scott Railton, there is no way for individual users to protect themselves from the threat of zero-click attacks, as it is not possible to know if a zero-click attack was launched.
That's why Scott Railton encourages users of Apple products to install the update released by Apple on September 13 as soon as possible.
Apple released a fix for the vulnerability reported on September 7th on the 13th, Scott Railton said, 'It's an extraordinary speed considering that Apple is a big company.' doing.
◆ Question 3: Why is iMessage targeted?
The flaws in iMessage surfaced when a similar 'zero-click vulnerability' was discovered in WhatsApp, a Facebook-affiliated messaging app. At this time, it was discovered that Pegasus was installed on journalists' terminals via WhatsApp.
The vulnerabilities found in WhatsApp are summarized in the following articles.
There is also an example of spyware installed, where a vulnerability was discovered in the chat app WhatsApp that could hijack a smartphone with a single phone call --GIGAZINE
by haberlernet NET
The Israeli company NSO Group , the developer of Pegasus, aimed at message apps such as WhatsApp and iMessage because these apps are widespread. Scott Railton points out that the messaging app is also a great target for hackers, as it allows you to identify individuals by phone number and easily locate your device.
◆ Question 4: Is it possible to prevent such hacking?
Many vulnerabilities have been fixed regularly on Apple's iOS and Google's Android, but NSO Group has a former elite member of the Israeli military intelligence department, so people who can put it into searching for weaknesses in apps and OS It is said that it has abundant resources. Also, since hackers sell access rights for apps on the dark web , even if OS and app developers take measures, they will be cat-and-mouse.
That's why Vivian Raoul, chief technology officer at French cybersecurity firm Pradeo, said, 'The identification of iMessage's vulnerabilities has helped reduce the number of routes that can get into the iPhone. But unfortunately it's not enough to stop Pegasus. '
Related Posts:
