Apple sues NSO Group, spyware vendor known for helping governments hack critics

The suit creates even more problems for the notorious spyware firm facing global scrutiny for its practices and clientele.

Apple is suing Israeli spyware vendor NSO Group “to hold it accountable for the surveillance and targeting of Apple users,” the company announced Tuesday.

The technology company is seeking to permanently ban NSO Group from using any Apple software, services or devices amid reports that the firm sells technology that makes it possible for governments to hack individual devices to spy on journalists, dissidents and human rights activists. As part of those efforts NSO Group has developed exploits capable of subverting Apple’s security controls, requiring “thousands of hours to investigate the attacks, identify the harm, diagnose the extent of the impact and exploitation, and develop and deploy the necessary repairs and patches to ensure that Apple servers,” the suit says. 

In a statement, NSO Group claimed without evidence that its technologies have saved lives around the world. The statement did not address Apple’s suit.

“State-sponsored actors like the NSO Group spend millions of dollars on sophisticated surveillance technologies without effective accountability,” Craig Federighi, Apple’s senior vice president of software engineering, said in a statement. “Apple devices are the most secure consumer hardware on the market — but private companies developing state-sponsored spyware have become even more dangerous.”

The U.S. government added NSO Group to its sanctions list on Nov. 4, citing its spyware being used to “maliciously target government officials, journalists, business people, activists, academics, and embassy workers.” The company had previously been sued by Facebook in 2019 for targeting WhatsApp users.

Apple said it’s lawsuit includes new information on NSO Group’s FORCEDENDTRY exploit, which used a since-patched iMessage vulnerability in Apple devices to install the Pegasus spyware.  In September the human rights group Citizen Lab discovered the exploit during an analysis of a Saudi activist’s phone. Investigators determined it was effective against Apple iOS, MacOS and WatchOS devices, suggesting it had been in use since at least February 2021.

In the suit, Apple’s lawyers refers to NSO Group as “notorious hackers—21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse.” Apple also alleges that NSO Group created more than 100 Apple IDs in pursuit of its work, which violates Apple iCloud’s terms of service which seeks to prevent it from being used to “stalk, harass, threaten or harm another.”

“NSO is now poison,” Ron Deibert, the director of Citizen Lab, told the New York Times, which first reported the suit. “No one in their right mind will want to touch that company. But it’s not just one company, this is an industrywide problem.”

NSO Group was already facing stiff headwinds after the U.S. government sanctions. Wall Street was treating the company as “distressed” and on the brink of being unable to pay its debt, Bloomberg previously reported. Its CEO stepped down after less than two weeks on the job.

Updated 11/23/21: To include a response from NSO Group.

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Google and Amnesty International teamed up to make it harder for spyware vendors to hide

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems