Bahrain hacked activists' iPhones with NSO Group spyware, Citizen Lab says

The new research raises concerns about iOS security.

Government hackers used NSO Group surveillance technology to infiltrate the phones of nine Bahraini activists, according to a new report from Citizen Lab.

The victims included a blogger, activist, members of political organization Waad and members of the Bahrain Center for Human Rights. Five of the targets identified by Citizen Lab, an internet watchdog from from the University of Toronto, were listed on a list of individuals obtained by Amnesty International as a part of its “Pegasus Project” investigation. The list is believed to comprise potential targets of NSO Group’s customers.

Hackers used fake texts that linked out to malicious software as well as “zero-click” attacks, which do not require any user interaction.

Researchers found that attackers successfully exploited the most recent versions of Apple iOS, circumventing protections introduced by the company in January to protect users against such attacks. Amnesty Tech has also reported zero-click exploits successfully exploiting iOS 14.6 as recently as July.

Given the nature of the targets and that one of the Pegaus operators operators exclusively in Bahrain, researchers believe that the Bahraini government is behind the operations detailed in the report. The Bahraini government has a long history of monitoring and retaliating against activists, with surveillance efforts dating back more than a decade.

Apple plans to release additional security measures for iMessage in its upcoming iOS 15 release, an Apple spokesperson told TechCrunch. The Bahraini government has denied Citizen Lab’s findings.

At least two of the victims discovered by CitizenLab were located in the United Kingdom at the time their phones were infiltrated, indicating that a second foreign government or actor with a history of successfully hacking inside the region may have been involved, researchers say.

NSO Group through a spokesperson accused Citizen Lab of failing to share research with the company that would allow it to mitigate human rights violations.

“Until they choose to cooperate and allow us to get to the bottom of this, it will be very difficult for us to conduct any real investigation,” the spokesperson wrote.

NSO Group said earlier this year it has removed several customers for human rights abuses but has not provided any additional details.

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

WhatsApp says it disrupted spyware campaign aimed at reporters, civil society

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems