Following WhatsApp's lead, Apple has filed a lawsuit against the company behind the Pegasus spyware, NSO Group. Along with new information about how NSO Group infected targeted iPhones via a zero-click exploit that researchers later dubbed ForcedEntry, Apple says it is "seeking a permanent injunction to prohibit NSO Group from using any Apple software, services, or devices."
See also: Dubai Sheikh uses NSO Group's Pegasus spyware to hack his ex-wife
Senior Vice President of Software Engineering, Craig Federighi said: “ Government agencies like NSO Group are spending millions of dollars on sophisticated surveillance technologies without effective accountability. This needs to change…Apple devices are the most secure consumer hardware on the market — but private companies developing state-sponsored spyware have become even more dangerous .” Apple and WhatsApp are not the only ones to have taken NSO Group to court, as last year tech companies including Microsoft and Google filed a brief supporting Facebook ’s lawsuit against it .
The Pegasus spyware is designed to allow governments to remotely access the microphones, cameras and other data of a phone, whether it’s an iPhone or Android, according to Apple’s press release. It’s also designed to be able to infect phones without requiring any action from the user and without leaving a trace, according to reports released earlier this year by a journalism coalition called the Pegasus Project and the Apple.
See also: Fake Amnesty International Pegasus scanner infects Windows devices
Apple also says the spyware has been used against journalists, activists, and politicians, despite NSO's claims that its government customers are prohibited from using the spyware against these kinds of targets. It's understandable why Apple, a staunch advocate of privacy, is upset about its devices and services being used to carry out what it calls "human rights abuses.".
Part of Apple's argument, laid out in the complaint, is that NSO violated Apple's terms of service because the group created "more than a hundred" Apple IDs to help it send data to targets.
Apple’s complaint details how the attack works, using Apple IDs it created, NSO would send data to a target via iMessage (after determining they were using an iPhone), which was maliciously crafted to disable the iPhone’s logging. This would allow NSO to secretly install the Pegasus spyware and control what was collected on the phone. Apple says the specific vulnerability used by NSO was patched in iOS 14.8.
See also: Pegasus spyware strikes again: Update iPhone, Mac, Apple Watch!
Essentially, NSO was sending files that exploited a bug in the way iMessage rendered GIFs and PDFs.
Apple says in its press release that, thanks to security improvements in iOS 15, it “has not observed any evidence of successful remote attacks against devices running iOS 15 and above.” When the Pegasus Project published its reports in July, Amnesty International said that the latest versions of iOS (then iOS 14.6) were vulnerable to attacks.
