iOS flaw (since fixed) enabled remote operation via link.

https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/

1. Executive Summary

Ahmed Mansoor is an internationally recognized human rights defender, based in the United Arab Emirates (UAE), and recipient of the Martin Ennals Award (sometimes referred to as a “Nobel Prize for human rights”). On August 10 and 11, 2016, Mansoor received SMS text messages on his iPhone promising “new secrets” about detainees tortured in UAE jails if he clicked on an included link. Instead of clicking, Mansoor sent the messages to Citizen Lab researchers. We recognized the links as belonging to an exploit infrastructure connected to NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product. NSO Group is reportedly owned by an American venture capital firm, Francisco Partners Management.

The ensuing investigation, a collaboration between researchers from Citizen Lab and from Lookout Security, determined that the links led to a chain of zero-day exploits (“zero-days”) that would have remotely jailbroken Mansoor’s stock iPhone 6 and installed sophisticated spyware. We are calling this exploit chain Trident. Once infected, Mansoor’s phone would have become a digital spy in his pocket, capable of employing his iPhone’s camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements.

We are not aware of any previous instance of an iPhone remote jailbreak used in the wild as part of a targeted attack campaign, making this a rare find.

[...]

Mansoor quickly forwarded the messages to Citizen Lab researchers for investigation. He has good reason to be concerned about unsolicited messages: every year since 2011, Mansoor has been targeted with spyware attacks, including with FinFisher spyware in 2011 and Hacking Team spyware in 2012 (see Section 8: Ahmed Mansoor and Previous UAE Attacks).

[...]

3. NSO Group and the Pegasus Solution

The attack on Mansoor appears to have used Pegasus, a remote monitoring solution sold by NSO Group Technologies Ltd (see Section 6: Linking NSO Group Products to the Attack on Mansoor). NSO Group, based in Herzelia, Israel (CR# 514395409), develops and sells mobile phone surveillance software to governments around the world. The company describes itself as a “leader” in “mobile and cellular Cyber Warfare,” and has been operating for more than six years since its founding in 2010.

NSO Group appears to be owned by a private equity firm with headquarters in San Francisco: Francisco Partners Management LLC, which reportedly acquired it in 2014 after approval from the Israeli Defense Ministry. However, as of November 2015, Francisco Partners was reportedly exploring selling NSO Group, with a stated valuation of up to $1 billion. Interestingly, Francisco Partners previously invested in Blue Coat, a company selling network filtering and monitoring solutions, whose technology has been used by repressive regimes according to previous Citizen Lab research.

[...]

Lots of details are there...

Cheers,
Scott.

The Inquirer: Researchers uncover new flaws in Apple's iOS

RESEARCHERS FROM North Carolina State University have revealed more security vulnerabilities in iOS just days after Apple was forced to patch three zero-day flaws in the widely used operating system.

o o o

The researchers uncovered a number of flaws that could enable them to launch different types of attack via third-party apps. These include:

Bypassing the iOS's privacy settings for contacts
Learning a user's location search history
Inferring sensitive information (such as when photos were taken) by accessing metadata of system files
Obtaining the user's name and media library
Consuming disk storage space that cannot be recovered by uninstalling the malicious app
Preventing access to system resources, such as the address book
Allowing apps to share information with each other without permission.

Enck said that Apple has been informed of the flaws and is already preparing patches.

Post #413,034 by Another Scott 8/25/16 4:27:58 PM 8/25/16 4:27:58 PM Reply	iOS flaw (since fixed) enabled remote operation via link. http://www.bbc.com/news/technology-37185544 Interesting. Who needs to break encryption when you can simply install spyware on the box? :-/ Cheers, Scott.
Post #413,040 by a6l6e6x 8/25/16 5:09:19 PM 8/25/16 5:09:19 PM Reply	Thank you! I had not seen that yet. Updating devices as I write this. Alex "There is a cult of ignorance in the United States, and there has always been. The strain of anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that "my ignorance is just as good as your knowledge." -- Isaac Asimov
Post #413,126 by Another Scott 8/28/16 9:20:59 PM 8/28/16 9:20:59 PM Reply	All the details on the exploit. https://citizenlab.org/2016/08/million-dollar-dissident-iphone-zero-day-nso-group-uae/ 1. Executive Summary Ahmed Mansoor is an internationally recognized human rights defender, based in the United Arab Emirates (UAE), and recipient of the Martin Ennals Award (sometimes referred to as a “Nobel Prize for human rights”). On August 10 and 11, 2016, Mansoor received SMS text messages on his iPhone promising “new secrets” about detainees tortured in UAE jails if he clicked on an included link. Instead of clicking, Mansoor sent the messages to Citizen Lab researchers. We recognized the links as belonging to an exploit infrastructure connected to NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product. NSO Group is reportedly owned by an American venture capital firm, Francisco Partners Management. The ensuing investigation, a collaboration between researchers from Citizen Lab and from Lookout Security, determined that the links led to a chain of zero-day exploits (“zero-days”) that would have remotely jailbroken Mansoor’s stock iPhone 6 and installed sophisticated spyware. We are calling this exploit chain Trident. Once infected, Mansoor’s phone would have become a digital spy in his pocket, capable of employing his iPhone’s camera and microphone to snoop on activity in the vicinity of the device, recording his WhatsApp and Viber calls, logging messages sent in mobile chat apps, and tracking his movements. We are not aware of any previous instance of an iPhone remote jailbreak used in the wild as part of a targeted attack campaign, making this a rare find. [...] Mansoor quickly forwarded the messages to Citizen Lab researchers for investigation. He has good reason to be concerned about unsolicited messages: every year since 2011, Mansoor has been targeted with spyware attacks, including with FinFisher spyware in 2011 and Hacking Team spyware in 2012 (see Section 8: Ahmed Mansoor and Previous UAE Attacks). [...] 3. NSO Group and the Pegasus Solution The attack on Mansoor appears to have used Pegasus, a remote monitoring solution sold by NSO Group Technologies Ltd (see Section 6: Linking NSO Group Products to the Attack on Mansoor). NSO Group, based in Herzelia, Israel (CR# 514395409), develops and sells mobile phone surveillance software to governments around the world. The company describes itself as a “leader” in “mobile and cellular Cyber Warfare,” and has been operating for more than six years since its founding in 2010. NSO Group appears to be owned by a private equity firm with headquarters in San Francisco: Francisco Partners Management LLC, which reportedly acquired it in 2014 after approval from the Israeli Defense Ministry. However, as of November 2015, Francisco Partners was reportedly exploring selling NSO Group, with a stated valuation of up to $1 billion. Interestingly, Francisco Partners previously invested in Blue Coat, a company selling network filtering and monitoring solutions, whose technology has been used by repressive regimes according to previous Citizen Lab research. [...] Lots of details are there... Cheers, Scott.
Post #413,129 by a6l6e6x 8/28/16 9:43:59 PM 8/28/16 9:43:59 PM Reply	Shame on Apple! The Inquirer: Researchers uncover new flaws in Apple's iOS RESEARCHERS FROM North Carolina State University have revealed more security vulnerabilities in iOS just days after Apple was forced to patch three zero-day flaws in the widely used operating system. o o o The researchers uncovered a number of flaws that could enable them to launch different types of attack via third-party apps. These include: Bypassing the iOS's privacy settings for contacts Learning a user's location search history Inferring sensitive information (such as when photos were taken) by accessing metadata of system files Obtaining the user's name and media library Consuming disk storage space that cannot be recovered by uninstalling the malicious app Preventing access to system resources, such as the address book Allowing apps to share information with each other without permission. Enck said that Apple has been informed of the flaws and is already preparing patches. Alex "There is a cult of ignorance in the United States, and there has always been. The strain of anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that "my ignorance is just as good as your knowledge." -- Isaac Asimov
Post #413,140 by pwhysall 8/29/16 9:49:13 AM 8/29/16 9:49:13 AM Reply	I know, right! It's just as well that we can turn to another much more secure mobile operating system, like Android! Oh, wait.
Post #413,167 by a6l6e6x 8/29/16 2:55:31 PM 8/29/16 2:55:31 PM Reply	Well, Apple is focusing on the whiz-bang instead of security. Android is just out of control. Too many cooks... Alex "There is a cult of ignorance in the United States, and there has always been. The strain of anti-intellectualism has been a constant thread winding its way through our political and cultural life, nurtured by the false notion that democracy means that "my ignorance is just as good as your knowledge." -- Isaac Asimov

Welcome to IWETHEY!