Researchers at Citizen Lab said they have found evidence that the iPhones of dozens of journalists were “silently” hacked by the spyware software “Pegasus” known to be used by many countries.
Rania Dridi, a London-based journalist, and at least 36 other journalists, producers and executives working for the Al Jazeera news agency were targeted in a “zero-click” attack in which hackers exploited a vulnerability in Apple ’s iMessage . The attack “silently” compromised devices without having to trick victims into clicking on a malicious link.
Citizen Lab was called in to investigate earlier this year after one of the victims, Al Jazeera investigative journalist Tamer Almisshal, suspected his phone had been hacked.
In a technical report released on December 20, researchers say they believe the journalists' iPhones were infected with the spyware software "Pegasus," which was developed by NSO Group, an Israel-based technology company.
Researchers analyzed iPhone and found that it had connected between July and August to servers known to be used by NSO to deliver the “Pegasus” spyware software. The device revealed a burst of network activity that suggests the spyware software may have been silently delivered via iMessage.
Logs from the phone show that the spyware could secretly record the microphone and phone calls, take photos using the phone's camera, access the victim's passwords, and track the phone's location.
Citizen Lab pointed out that the bulk of the breaches on journalists' iPhones were likely carried out by at least four NSO clients, including the governments of Saudi Arabia and the United Arab Emirates, citing evidence it found in similar attacks linked to Pegasus.
Researchers found evidence that two other NSO clients hacked into phones linked to Al Jazeera, but were unable to attribute the attacks to a specific government.
NSO sells governments and states access to the Pegasus spyware as a pre-packaged service, providing the infrastructure and advantages needed to launch the spyware against the clients’ targets. NSO’s well-known clients include authoritarian regimes. For example, Saudi Arabia is said to have used the technology to spy on the communications of columnist Jamal Khashoggi shortly before his murder, which is said to have been orchestrated by Saudi Crown Prince Mohammed bin Salman.
Citizen Lab said it also found evidence that Dridi, a journalist at the Arabic-language Al Araby TV station in London, had been the victim of a zero-click attack. The researchers said Dridi was likely targeted by the UAE government. In a phone call, Dridi told TechCrunch that her phone may have been targeted because of her close relationship with a person of interest to the UAE. Representatives for the Saudi Arabian and UAE governments in New York have not yet commented on the matter.
The attacks not only put a new spotlight on the murky world of spyware, but also on the companies that need to build defenses to protect themselves from it. Apple bases much of its public image on defending its users' privacy and building secure devices like iPhones. Still, no technology is impervious to security flaws
Apple told TechCrunch that the flaws exploited to target journalists were fixed in iOS 14, which was released in September. Specifically, a spokesperson for the tech giant said the following: “At Apple, our teams work tirelessly to strengthen the security of our users’ data and devices. iOS 14 is a significant leap forward in security by providing new protections against these types of attacks. The attack described in the research was mostly carried out by nation-states against specific individuals. We always encourage customers to download the latest version of software to protect themselves and their data.
NSO is currently embroiled in a legal dispute with Facebook, which last year accused the Israeli spyware maker of using a previously undisclosed zero-click exploit in WhatsAppto infect around 1,400 devices with the Pegasus spyware.
Facebook discovered and fixed the vulnerability, stopping the attack, but said that more than 100 human rights activists, journalists and "other members of civil society" have been victims of such attacks.
