A report published by security experts at Citizen Lab, a Canada-based cybersecurity watchdog, said it has detected "zero-day zero-click exploit against iMessage" which it calls "forcendentry" or "forced entry".&nbsp;

The mechanism targets "Apple’s image rendering library" and "was effective against <a href="https://www.wionews.com/technology/apple-takes-app-payment-hit-in-epic-court-fight-412259">Apple</a> iOS, MacOS and WatchOS devices", the watchdog said.

"Zero-click exploit" means spyware can be deployed without the person even clicking on a link or a file.

"We determined that the mercenary spyware company NSO Group used the vulnerability to remotely exploit and infect the latest Apple devices with the Pegasus spyware," it said. NSO is an&nbsp;Israeli software company.

The lab said "forcendentry" has been in use since February. It added that after discovering the vulnerability, the code was sent to Apple and the company has "assigned forcendentry vulnerability CVE-2021-30860".&nbsp;

Watch:

<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/explainer-what-is-pegasus-spyware-how-does-it-hack-into-your-phone-to-spy-on-you-399205/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>

<a href="https://www.wionews.com/technology/apple-to-allow-developers-to-email-customers-about-payment-options-408878">Apple</a> has described it as “processing a maliciously crafted PDF may lead to arbitrary code execution”, the lab said in its report.

The lab discovered the issue while analysing a Saudi activist's phone which was reportedly infected with <a href="https://www.wionews.com/world/nsos-notorious-pegasus-spyware-secretly-bought-by-police-in-germany-reports-411667">NSO</a> Group’s Pegasus spyware.

The researchers said unknown vulnerability affected all major Apple devices including Apple watches, Macs and iPhones. The NSO group in a statement said it will "continue to provide intelligence and law enforcement agencies around the world with life-saving technologies to fight terror and crime."

Meanwhile, Apple in a statement said it was correcting the error "rapidly".&nbsp;

"Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals," the company said.

(With inputs from Agencies)

A report published by security experts at Citizen Lab, a Canada-based cybersecurity watchdog, said it has detected "zero-day zero-click exploit against iMessage" which it calls "forcendentry" or "forced entry".

A report published by security experts at Citizen Lab, a Canada-based cybersecurity watchdog, said it has detected "zero-day zero-click exploit against iMessage" which it calls "forcendentry" or "forced entry". The mechanism targets "Apple’s image rendering library" and "was effective against Apple iOS, MacOS and WatchOS devices", the watchdog said. "Zero-click exploit" means spyware can be deployed without the person even clicking on a link or a file. "We determined that the mercenary spyware company NSO Group used the vulnerability to remotely exploit and infect the latest Apple devices with the Pegasus spyware," it said. NSO is an Israeli software company. The lab said "forcendentry" has been in use since February. It added that after discovering the vulnerability, the code was sent to Apple and the company has "assigned forcendentry vulnerability CVE-2021-30860". Watch: Apple has described it as “processing a maliciously crafted PDF may lead to arbitrary code execution”, the lab said in its report. The lab discovered the issue while analysing a Saudi activist's phone which was reportedly infected with NSO Group’s Pegasus spyware. The researchers said unknown vulnerability affected all major Apple devices including Apple watches, Macs and iPhones. The NSO group in a statement said it will "continue to provide intelligence and law enforcement agencies around the world with life-saving technologies to fight terror and crime." Meanwhile, Apple in a statement said it was correcting the error "rapidly". "Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals," the company said. (With inputs from Agencies)

Apple's iMessage targeted by Pegasus spyware from Israeli firm NSO, says cybersecurity watchdog

Israel secretly authorized a group of cyber-surveillance firms to work for the government of Saudi Arabia despite international condemnation of the kingdom’s abuse of surveillance software to crush dissent, even after the Saudi killing of journalist Jamal Khashoggi, government officials and others familiar with the contracts said.

After the murder of Khashoggi in 2018, one of the firms, NSO Group, cancelled its contracts with Saudi Arabia amid accusations that its hacking tools were being misused to abet heinous crimes.

Also read |&nbsp;<a href="https://www.wionews.com/world/jamal-khashoggi-murder-saudi-arabia-court-hands-death-penalty-to-five-24-years-imprisonment-to-three-269717">Jamal Khashoggi murder: Saudi Arabia court hands death penalty to five, 24 years imprisonment to three</a>

But the Israeli government encouraged NSO and two other companies to continue working with Saudi Arabia and issued a new license for a fourth to do similar work, overriding any concerns about human rights abuses, according to one senior Israeli official and three people affiliated with the companies.

Since then, Saudi Arabia has continued to use the spyware to monitor dissidents and political opponents.

The fact that Israel’s government has encouraged its private companies to do security work for the kingdom — one of its historic adversaries and a nation that still does not formally recognize Israel — is yet more evidence of the reordering of traditional alliances in the region and the strategy by Israel and several Persian Gulf countries to join forces to isolate Iran.

Also read |&nbsp;<a href="https://www.wionews.com/world/biden-to-declassify-report-on-assassination-of-jamal-khashoggi-357888">Biden to declassify report on assassination of Jamal Khashoggi</a>

NSO is by far the best known of the Israeli firms, largely because of revelations in the past few years that its Pegasus program was used by numerous governments to spy on, and eventually imprison, human rights activists.

NSO sold Pegasus to Saudi Arabia in 2017. The kingdom used the spyware as part of a ruthless campaign to crush dissent inside the kingdom and to hunt down Saudi dissidents abroad.

It is not publicly known whether Saudi Arabia used Pegasus or other Israeli-made spyware in the plot to kill Khashoggi. NSO has denied that its software was used.

Israel’s Ministry of Defense also licensed for Saudi work a company called Candiru, which Microsoft accused last week of helping its government clients spy on more than 100 journalists, politicians, dissidents and human rights advocates around the world.

Also read |&nbsp;<a href="https://www.wionews.com/technology/israeli-company-is-behind-malware-that-affected-windows-pcs-microsoft-398381">Israeli company is behind malware that affected Windows PCs: Microsoft</a>

Microsoft, which conducted its investigation in tandem with Citizen Lab, a research institute at the University of Toronto, said Candiru had used malware to exploit a vulnerability in Microsoft products, enabling its government clients to spy on perceived enemies.

Candiru has had at least one contract with Saudi Arabia since 2018.

Israel has also granted licenses to at least two other firms, Verint, which was licensed before the Khashoggi killing, and Quadream, which signed a contract with Saudi Arabia after the killing.

A fifth company, Cellebrite, which manufactures physical hacking systems for mobile phones, has also sold its services to the Saudi government, but without ministry approval, according to the newspaper Haaretz.

Israel insists that if any Israeli spyware were used to violate civil rights that it would revoke the company’s license.

If the Defense Ministry “discovers that the purchased item is being used in contravention of the terms of the license, especially after any violation of human rights, a procedure of cancellation of the defense export license or of enforcing its terms is initiated,” the ministry said in a statement in response to questions from The New York Times.

Also read |&nbsp;<a href="https://www.wionews.com/world/saudis-who-killed-journalist-khashoggi-received-paramilitary-training-in-us-report-393221">Saudis who killed journalist Khashoggi received paramilitary training in US: Report</a>

The ministry declined to respond to specific questions about the licenses it gave to the Israeli firms, but said that “a wide range of security, diplomatic and strategic considerations are taken into account” when considering whether to grant a license to export offensive cyber technology.

Revelations about the abuses of NSO products led the company to hire a group of outside consultants in 2018 to provide advice about which new clients NSO should take on and which to avoid. The group included Daniel Shapiro, the former Obama administration ambassador to Israel, and Beacon Global Strategies, a Washington strategic consulting firm.

Beacon is led by Jeremy Bash, a former CIA and Pentagon chief of staff; Michael Allen, a former staff director for the House Intelligence Committee; and Andrew Shapiro, a former top State Department official.

While the group’s mandate was to vet potential new clients, the international outrage over Khashoggi’s killing in October 2018 led the group to advise NSO to cancel its Saudi contracts and shut down NSO systems in the kingdom.

Also read |&nbsp;<a href="https://www.wionews.com/world/activists-call-for-fresh-probe-into-killings-of-turkish-journalists-386949">Activists call for fresh probe into killings of Turkish journalists</a>

Separately, NSO conducted an internal investigation into whether any of its tools were used by Saudi officials for the Khashoggi operation and concluded that they were not. However a lawsuit against NSO by a friend of Khashoggi’s claims that his phone had been hacked by Saudi Arabia using Pegasus, and that hack gave Saudi officials access to his conversations with Khashoggi, including communications about opposition projects.

Over several days in late 2018, executives both of NSO and the private equity firm that owned it at the time, Francisco Partners, met in Washington with the advisory group.

According to several people familiar with the meetings, the NSO executives argued that the Israeli government was strongly encouraging the company to weather the storm and continue its work in Saudi Arabia. They also said that Israeli officials had indicated to them that the <a href="https://www.wionews.com/topics/donald-trump">Trump</a> administration also wanted NSO’s work with Saudi Arabia to continue.

In the end, NSO management heeded the advice of the outside group and canceled its contracts with Saudi Arabia in late 2018. Shapiro, the former ambassador to Israel, ended his work for the company shortly afterward.

Also read |&nbsp;<a href="https://www.wionews.com/world/wion-investigates-unearthing-the-nso-controversy-260269">WION investigates: Unearthing the NSO controversy</a>

Months later, however, after another private equity firm bought NSO, the company was once again doing business with Saudi Arabia.

NSO’s new owner, Novalpina, rejected the advice of the outside advisory group and NSO resumed its work in Saudi Arabia in mid-2019. Around that time, Beacon ended its work with NSO.

The new contract with the Saudis came with some restrictions. For example, NSO set up its system to block any attempts by Saudi officials to hack European telephone numbers, according to a person familiar with the programming.

But it is clear that Saudi Arabia has continued to use NSO software to spy on perceived opponents abroad.

In one case that has come to light, three dozen phones belonging to journalists at Al-Jazeera, which Saudi Arabia considers a threat, were hacked using NSO’s Pegasus software last year, according to Citizen Lab. Citizen Lab traced 18 of the attacks back to Saudi intelligence.

After the revelation of the attack on Al-Jazeera journalists, NSO recently shut down the system, and at a meeting in early July, the company’s board decided to declare new deals with Saudi Arabia off-limits, according to a person familiar with the decision.

Israel’s defense ministry is currently fighting lawsuits by Israeli rights activists demanding that it release details about its process for granting the licenses.

The Israeli government also imposes strict secrecy on the companies that receive the licenses, threatening to revoke them if the companies speak publicly about the identity of their clients.

An NSO statement said the company could not discuss the identity of its government customers, but added: “As NSO has previously stated, our technology was not associated in any way with the heinous murder of Jamal Khashoggi. This includes listening, monitoring, tracking or collecting information.”

Officials with Candiru, Verint and the government of Saudi Arabia declined to comment. Officials with Quadream could not be reached.

These business ties came as Israel was quietly building relationships directly with the Saudi government.

Benjamin Netanyahu, then Israel’s prime minister, met several times with Saudi Arabia’s day-to-day ruler, Crown Prince Mohammed bin Salman, and military and intelligence leaders of the two countries meet frequently.

While Saudi Arabia was not officially party to the Abraham Accords — the diplomatic initiatives during the end of the Trump administration normalizing relations between Israel and several Arab countries — Saudi leaders worked behind the scenes to help broker the deals.

Israel secretly authorized a group of cyber-surveillance firms to work for the government of Saudi Arabia despite international condemnation of the kingdom’s abuse of surveillance software to crush dissent, even after the Saudi killing of journalist Jamal Khashoggi, government officials and others familiar with the contracts said.

Israel secretly authorized a group of cyber-surveillance firms to work for the government of Saudi Arabia despite international condemnation of the kingdom’s abuse of surveillance software to crush dissent, even after the Saudi killing of journalist Jamal Khashoggi, government officials and others familiar with the contracts said. After the murder of Khashoggi in 2018, one of the firms, NSO Group, cancelled its contracts with Saudi Arabia amid accusations that its hacking tools were being misused to abet heinous crimes. Also read | Jamal Khashoggi murder: Saudi Arabia court hands death penalty to five, 24 years imprisonment to three But the Israeli government encouraged NSO and two other companies to continue working with Saudi Arabia and issued a new license for a fourth to do similar work, overriding any concerns about human rights abuses, according to one senior Israeli official and three people affiliated with the companies. Since then, Saudi Arabia has continued to use the spyware to monitor dissidents and political opponents. The fact that Israel’s government has encouraged its private companies to do security work for the kingdom — one of its historic adversaries and a nation that still does not formally recognize Israel — is yet more evidence of the reordering of traditional alliances in the region and the strategy by Israel and several Persian Gulf countries to join forces to isolate Iran. Also read | Biden to declassify report on assassination of Jamal Khashoggi NSO is by far the best known of the Israeli firms, largely because of revelations in the past few years that its Pegasus program was used by numerous governments to spy on, and eventually imprison, human rights activists. NSO sold Pegasus to Saudi Arabia in 2017. The kingdom used the spyware as part of a ruthless campaign to crush dissent inside the kingdom and to hunt down Saudi dissidents abroad. It is not publicly known whether Saudi Arabia used Pegasus or other Israeli-made spyware in the plot to kill Khashoggi. NSO has denied that its software was used. Israel’s Ministry of Defense also licensed for Saudi work a company called Candiru, which Microsoft accused last week of helping its government clients spy on more than 100 journalists, politicians, dissidents and human rights advocates around the world. Also read | Israeli company is behind malware that affected Windows PCs: Microsoft Microsoft, which conducted its investigation in tandem with Citizen Lab, a research institute at the University of Toronto, said Candiru had used malware to exploit a vulnerability in Microsoft products, enabling its government clients to spy on perceived enemies. Candiru has had at least one contract with Saudi Arabia since 2018. Israel has also granted licenses to at least two other firms, Verint, which was licensed before the Khashoggi killing, and Quadream, which signed a contract with Saudi Arabia after the killing. A fifth company, Cellebrite, which manufactures physical hacking systems for mobile phones, has also sold its services to the Saudi government, but without ministry approval, according to the newspaper Haaretz. Israel insists that if any Israeli spyware were used to violate civil rights that it would revoke the company’s license. If the Defense Ministry “discovers that the purchased item is being used in contravention of the terms of the license, especially after any violation of human rights, a procedure of cancellation of the defense export license or of enforcing its terms is initiated,” the ministry said in a statement in response to questions from The New York Times. Also read | Saudis who killed journalist Khashoggi received paramilitary training in US: Report The ministry declined to respond to specific questions about the licenses it gave to the Israeli firms, but said that “a wide range of security, diplomatic and strategic considerations are taken into account” when considering whether to grant a license to export offensive cyber technology. Revelations about the abuses of NSO products led the company to hire a group of outside consultants in 2018 to provide advice about which new clients NSO should take on and which to avoid. The group included Daniel Shapiro, the former Obama administration ambassador to Israel, and Beacon Global Strategies, a Washington strategic consulting firm. Beacon is led by Jeremy Bash, a former CIA and Pentagon chief of staff; Michael Allen, a former staff director for the House Intelligence Committee; and Andrew Shapiro, a former top State Department official. While the group’s mandate was to vet potential new clients, the international outrage over Khashoggi’s killing in October 2018 led the group to advise NSO to cancel its Saudi contracts and shut down NSO systems in the kingdom. Also read | Activists call for fresh probe into killings of Turkish journalists Separately, NSO conducted an internal investigation into whether any of its tools were used by Saudi officials for the Khashoggi operation and concluded that they were not. However a lawsuit against NSO by a friend of Khashoggi’s claims that his phone had been hacked by Saudi Arabia using Pegasus, and that hack gave Saudi officials access to his conversations with Khashoggi, including communications about opposition projects. Over several days in late 2018, executives both of NSO and the private equity firm that owned it at the time, Francisco Partners, met in Washington with the advisory group. According to several people familiar with the meetings, the NSO executives argued that the Israeli government was strongly encouraging the company to weather the storm and continue its work in Saudi Arabia. They also said that Israeli officials had indicated to them that the Trump administration also wanted NSO’s work with Saudi Arabia to continue. In the end, NSO management heeded the advice of the outside group and canceled its contracts with Saudi Arabia in late 2018. Shapiro, the former ambassador to Israel, ended his work for the company shortly afterward. Also read | WION investigates: Unearthing the NSO controversy Months later, however, after another private equity firm bought NSO, the company was once again doing business with Saudi Arabia. NSO’s new owner, Novalpina, rejected the advice of the outside advisory group and NSO resumed its work in Saudi Arabia in mid-2019. Around that time, Beacon ended its work with NSO. The new contract with the Saudis came with some restrictions. For example, NSO set up its system to block any attempts by Saudi officials to hack European telephone numbers, according to a person familiar with the programming. But it is clear that Saudi Arabia has continued to use NSO software to spy on perceived opponents abroad. In one case that has come to light, three dozen phones belonging to journalists at Al-Jazeera, which Saudi Arabia considers a threat, were hacked using NSO’s Pegasus software last year, according to Citizen Lab. Citizen Lab traced 18 of the attacks back to Saudi intelligence. After the revelation of the attack on Al-Jazeera journalists, NSO recently shut down the system, and at a meeting in early July, the company’s board decided to declare new deals with Saudi Arabia off-limits, according to a person familiar with the decision. Israel’s defense ministry is currently fighting lawsuits by Israeli rights activists demanding that it release details about its process for granting the licenses. The Israeli government also imposes strict secrecy on the companies that receive the licenses, threatening to revoke them if the companies speak publicly about the identity of their clients. An NSO statement said the company could not discuss the identity of its government customers, but added: “As NSO has previously stated, our technology was not associated in any way with the heinous murder of Jamal Khashoggi. This includes listening, monitoring, tracking or collecting information.” Officials with Candiru, Verint and the government of Saudi Arabia declined to comment. Officials with Quadream could not be reached. These business ties came as Israel was quietly building relationships directly with the Saudi government. Benjamin Netanyahu, then Israel’s prime minister, met several times with Saudi Arabia’s day-to-day ruler, Crown Prince Mohammed bin Salman, and military and intelligence leaders of the two countries meet frequently. While Saudi Arabia was not officially party to the Abraham Accords — the diplomatic initiatives during the end of the Trump administration normalizing relations between Israel and several Arab countries — Saudi leaders worked behind the scenes to help broker the deals.

Israeli companies aided Saudi spying despite Khashoggi killing

NSO snooping row now raised in Indian Parliament, Indian IT Minister replies in writing. Watch this video to understand the complete matter.

NSO snooping row now raised in Indian Parliament, Indian IT Minister replies in writing

nso-snooping-row

Nso Snooping Row, News on Nso Snooping Row, stories on Nso Snooping Row, articles on Nso Snooping Row, Nso Snooping Row stories at Wion, Nso Snooping Row news, Nso Snooping Row latest news

nso snooping-row

Apple's iMessage targeted by Pegasus spyware from Israeli firm NSO, says cybersecurity watchdog

Israeli companies aided Saudi spying despite Khashoggi killing

NSO snooping row now raised in Indian Parliament, Indian IT Minister replies in writing