Patrick Domingues

The Citizen Lab has discovered a zero-click zero-day flaw in all Apple products. The new zero-day flaw is called ForcedEntry, and it affects iPhones, iPads, Macs, Apple Watches, and even AirPods. Citizen Lab urges all Apple users to update their devices immediately.

Apple released a Security update on Monday. The iOS 14.8 for iPhones and iPads includes patches for vulnerabilities, which may have been exploited by hackers. Also included are Apple Watch and macOS updates.

Citizen Lab, a digital watchdog, discovered a new kind of spyware that is used to illegally monitor activists’ iPhone communications. It’s allegedly been used by the NSO Group to target the communications of people in Bahrain. The researchers called this new zero-click attack ForcedEntry. Citizen Lab said it had identified nine Bahraini activists whose iPhones had been targeted with Pegasus spyware between June of 2020 and February of 2021. These phones suffered zero-click attacks that included the exploits KISMET and ForcedEntry.

However, Citizen Lab believes that in this particular case, with these particular attacks, disabling iMessage and FaceTime might have prevented the threat actors from succeeding. “Disabling iMessage and FaceTime would not offer complete protection from zero-click attacks or surveillance, but it would prevent the most recent version of Pegasus from being installed on a target’s device”

UPDATE, Sept. 14 a.m. ET: After the story was published, Apple sent the following statement by Ivan Krstić, head of Apple Security Engineering and Architecture:

“After identifying the vulnerability used by this exploit for iMessage, Apple rapidly developed and deployed a fix in iOS 14.8 to protect our users. We’d like to commend Citizen Lab for successfully completing the very difficult work of obtaining a sample of this exploit so we could develop this fix quickly. Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals. While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data.”

What to do?

Make sure that all your apple branded devices have the latest patches. But also keep in mind that at any moment you could be vulnerable. Maintain vigilant and up to date with vulnerabilities for your devices.  

I hope this article was helpful, if you have any questions please feel free to contact me. If you would like to be notified of when I create a new post you can subscribe to my blog alert.

Patrick Domingues

See Full Bio