Israeli surveillance firm QuaDream emerges from the dark
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-30860 | Integer Overflow in Apple PDF Processing Enables Arbitrary Code Execution (CVE-2021-30860) CVE-2021-30860 is an integer overflow (CWE-190) in PDF processing across Apple's platforms that was addressed with improved input validation. It is triggered when a device processes a maliciously crafted PDF — notably when a PDF is rendered after being received via messaging — and successful exploitation allows arbitrary code execution in the context of the PDF renderer. Affected products include iOS/iPadOS, macOS (Big Sur and Catalina), and watchOS, as well as the Xpdf and Poppler PDF libraries, which share lineage with the vulnerable code. Apple confirmed the issue was being actively exploited in the wild, and public reporting ties it to NSO Group's 'ForcedEntry' exploit chain used to deliver Pegasus spyware; CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03. Given the very high EPSS score (76%, 99th percentile) and confirmed active exploitation, defenders should treat this as a high-priority patch. Do: Update iPhones/iPads to iOS/iPadOS 14.8, Macs to macOS Big Sur 11.6 (or apply Security Update 2021-005 Catalina), and Apple Watch to watchOS 7.6.2 immediately, and patch Poppler/Xpdf through distribution or vendor updates. Because the flaw was exploited via crafted PDFs delivered through messaging (ForcedEntry/Pegasus), organizations and individuals at risk of targeted spyware should also review devices for signs of compromise. CISA KEV requires applying updates per vendor instructions; prioritize internet-connected and high-value user endpoints. | 7.8 | 76% | KEV |
| mass>1 billion active Apple devices (iPhones, iPads, Macs, Apple Watches), plus Poppler present by default on most Linux desktops and servers |
Full article671 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
February 06, 2022
One of the Apple iOS zero-day flaws exploited by the NSO group was also used by another surveillance firm named QuaDream.
One of the vulnerabilities in Apple iOS that was previously exploited by the spyware developed by the Israeli company NSO Group was also separately used by another surveillance firm named QuaDream.
Like NSO Group, QuaDream develops surveillance malware for government and intelligence agencies.
QuaDream was founded in 2016 by Ilan Dabelstein, a former Israeli military official, and by two former NSO employees, Guy Geva and Nimrod Reznik.
“A flaw in Apple’s software exploited by Israeli surveillance firm NSO Group to break into iPhones in 2021 was simultaneously abused by a competing company, according to five people familiar with the matter.” reads the article published by Reuters. “QuaDream, the sources said, is a smaller and lower profile Israeli firm that also develops smartphone hacking tools intended for government clients.”
The interesting aspect of the news shared by Reuters is that both firms were weaponizing the iOS zero-day in the same period, according to the five sources.
The two companies were able to remotely compromise iPhone devices without any user interaction.
The two surveillance firms employed the zero-click iMessage exploit dubbed FORCEDENTRY (CVE-2021-30860). Apple addressed the flaw used by the ForcedEntry exploit in September 2021, rendering both NSO and QuaDream’s spyware ineffective.
In August 2021, researchers from Citizen Lab discovered the zero-click iMessage exploit that was used to deploy NSO Group’s Pegasus spyware on Bahraini activists’ devices.
The iPhones of nine activists, including members of the Bahrain Center for Human Rights, Waad, Al Wefaq, were infected with Pegasus spyware as part of a surveillance operation likely orchestrated by a threat actor tracked as LULU and attributed with high confidence to the government of Bahrain.
“We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. Some of the activists were hacked using two zero-click iMessage exploits: the 2020 KISMET exploit and a 2021 exploit that we call FORCEDENTRY.” reads the analysis published by citizen Lab.
“We saw the FORCEDENTRY exploit successfully deployed against iOS versions 14.4 and 14.6 as a zero-day. With the consent of targets, we shared these crash logs and some additional phone logs relating o KISMET and FORCEDENTRY with Apple, Inc., which confirmed they were investigating.”
Threat actors leveraged two zero-click iMessage exploits to infect the iPhones with spyware, respectively known as 2020 KISMET exploit and a new exploit dubbed FORCEDENTRY.
Citizen Lab researchers discovered that the FORCEDENTRY exploit is able to bypass the “BlastDoor” sandbox introduced eight months ago in iOS to block iMessage zero-click exploits.
The spyware developed by QuaDream is named REIGN, it has the same capabilities as the NSO Group’s Pegasus spyware, it allows operators to gain full control of the device.
“REIGN’s “Premium Collection” capabilities included the “real time call recordings”, “camera activation – front and back” and “microphone activation”” reads a brochure of the spyware.
An NSO spokeswoman sent a written statement to Reuter to clarify that the company “did not cooperate” with QuaDream but he pointed out that “the cyber intelligence industry continues to grow rapidly globally.”
Reuters also shared information about the prices of QuaDream’s services reported in a 2019 brochure. One QuaDream system allows to hack into 50 smartphones per year and is offered for $2.2 million, exclusive of maintenance costs.
“Several of QuaDream’s buyers have also overlapped with NSO’s, four of the sources said, including Saudi Arabia and Mexico – both of whom have been accused of misusing spy software to target political opponents.” concludes Reuters. “One of QuaDream’s first clients was the Singaporean government, two of the sources said, and documentation reviewed by Reuters shows the company’s surveillance technology was pitched to the Indonesian government as well. Reuters couldn’t determine if Indonesia became a client.”
Follow me on Twitter: @securityaffairs and Facebook
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, QuaDream)
[adrotate banner=”5″]
[adrotate banner=”13″]
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/127721/malware/surveillance-firm-quadream.html