A new actively exploited zero-day vulnerability in iOS has been disclosed by ...

deltatux :donor: /

npub1g8r…ngjw

2023-09-07 20:17:46

A new actively exploited zero-day vulnerability in iOS has been disclosed by researchers from npub1h662kslx3s4e4y0ny97snasj8d0m22yld2xt6rn8zjpyj8nz4f7q8e0ec3 (npub1h66…0ec3).

This vulnerability is being used by the "BLASTPASS" exploit to deploy NSO Group's Pegasus mercenary spyware. The exploit involves a PassKit attachment that contains malicious images sent from an attacker iMessage account to its victim. The researchers also note that no user interaction is required by the victim for this exploit to work.

Apple has since released patches for this zero-day vulnerability. Both Apple & Citizen Lab urges iPhone users to update as soon as possible.

https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/

Apple security advisory: https://support.apple.com/en-us/HT213905

#infosec #cybersecurity #zeroday #blastpass #citizenlab #nsogroup #pegasus #spyware #iOS #iPhone #iMessage #patchnow

Author Public Key

npub1g8rmsdslpcemhyvnqv624hsc2jm0tfzr2anm674zrksszw3atvzsw9ngjw

Show more details

Published at

2023-09-07 20:17:46

Kind type

1 Short Text Note

Event JSON

{ "id": "1d39a7ff37160664d0b42bcdb569e04b99cf2d46078936dc3c347373e807b816", "pubkey": "41c7b8361f0e33bb91930334aade1854b6f5a4435767bd7aa21da1013a3d5b05", "created_at": 1694117866, "kind": 1, "tags": [ [ "p", "beb4ab43e68c2b9a91f3217d09f6123b5fb5289f6a8cbd0e671482491e62aa7c", "wss://relay.mostr.pub" ], [ "p", "48484737f8444aea04613fc9f77b5249e005e3e398474551ba7491b81dd5cf64", "wss://relay.mostr.pub" ], [ "t", "infosec" ], [ "t", "cybersecurity" ], [ "t", "zeroday" ], [ "t", "blastpass" ], [ "t", "citizenlab" ], [ "t", "nsogroup" ], [ "t", "pegasus" ], [ "t", "spyware" ], [ "t", "ios" ], [ "t", "iphone" ], [ "t", "imessage" ], [ "t", "patchnow" ], [ "proxy", "https://infosec.town/notes/9jd6cl6tbyjze241", "activitypub" ] ], "content": "A new actively exploited zero-day vulnerability in iOS has been disclosed by researchers from nostr:npub1h662kslx3s4e4y0ny97snasj8d0m22yld2xt6rn8zjpyj8nz4f7q8e0ec3.\n\nThis vulnerability is being used by the \"BLASTPASS\" exploit to deploy NSO Group's Pegasus mercenary spyware. The exploit involves a PassKit attachment that contains malicious images sent from an attacker iMessage account to its victim. The researchers also note that no user interaction is required by the victim for this exploit to work.\n\nApple has since released patches for this zero-day vulnerability. Both Apple \u0026 Citizen Lab urges iPhone users to update as soon as possible.\n\nhttps://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/\n\nApple security advisory: https://support.apple.com/en-us/HT213905\n\n#infosec #cybersecurity #zeroday #blastpass #citizenlab #nsogroup #pegasus #spyware #iOS #iPhone #iMessage #patchnow", "sig": "0bdb3cb2681a692c3e7000546bebd6aa0d3b825de11c72abc7175c28377f5c446bf057e5f9c74acd43aa8d427e8d4531305369ab0d223f32a9a3cb031b01ede0" }