0

I'm interested to know how someone would be able to hack (i.e. gain remote access) to an iPhone. Would knowing the iCloud password tied to the device be sufficient? Or would they also need to have gotten physical access to the device?

How would this work? This happened to me, and I'd like to know how to recover and prevent this from happening.

For context, they managed to send a remote apple event to my phone while I was updating my software over wifi (a shame that Apple only allows iPhones to be updated over wifi btw). The prompt looks exactly the same as an iCloud authentication prompt. Declined a few times just to be sure, and it wouldn't allow me to proceed with installing the update. Hence, I figured it might be a legit iOS password prompt to authenticate before installing the latest updates.

A few days later I realized that my phone started leaking information and my iCloud settings have changed on their own. Tried wiping the device, and it won't allow me while giving a prompt that the phone is in the process of uploading files to iCloud (when I have never synced anything with my account).

Appreciate any feedback on this, thank you.

Improve this question
7
  • Trojan app from app store, remote code execution or by exploiting a critical vulnerability with physical access.
    – defalt
    Sep 17, 2021 at 20:08
  • Thank you for your response. Would they need my iCloud credentials for the above to work? Highly unlikely that it was anything from the app store since I updated the software before installing anything. I'm just trying to figure out what are all the vectors required for a remote attack. Once I've weeded them all out, I can then zero in on the possibility of physical access.
    – Albert Kinterman
    Sep 18, 2021 at 2:44
  • Your iCloud credentials are not required. App store can have apps that are loaded with trojan. Updating iOS doesn't guarantee security from unknown vulnerabilities. You may have been targeted by Pegasus malware. Pegasus has multiple entrypoints that are being constantly updated to get around security patches. Buffer overflow through WhatsApp calling was one of the entrypoint.
    – defalt
    Sep 18, 2021 at 9:31
  • Figured this might have been the case, though I wasn't expecting it. Apple recently issued a patch for the latest strain, though I can't find any info on whether the patch only prevents an attack or does it also fix phones which have already been compromised. Any ideas? Also, is there a list of entrypoints for Pegasus?
    – Albert Kinterman
    Sep 18, 2021 at 17:41
  • In general, security patches does not fix compromised devices because you can factory reset the device which restores the device back to its good state. As entrypoints are being constantly updated by NSO, you can only find reports on discovered methods. You can also submit your device to anti-virus agencies if your device shows symptoms of possible compromise.
    – defalt
    Sep 21, 2021 at 9:47

1 Answer 1

Reset to default
2

Here is a recent exploit in the news:

new-zero-click-iphone-exploit-used-to-deploy-nso-spyware

New zero-click iPhone exploit used to deploy NSO spyware

New iPhone zero-click exploit in use since February 2021

NSO Group attacks using the new iMessage zero-click (which circumvents the iOS BlastDoor feature designed to block such exploits) were first spotted in February 2021.

"We saw the FORCEDENTRY exploit successfully deployed against iOS versions 14.4 and 14.6 as a zero-day," Citizen Lab said.

"With the consent of targets, we shared these crash logs and some additional phone logs relating to KISMET and FORCEDENTRY with Apple, Inc., which confirmed they were investigating."

While protecting against the iMessage exploits would only require disabling iMessage and FaceTime, NSO Group has also used exploits targeting other messaging apps, including WhatsApp.

Furthermore, disabling iMessage will lead to other issues, including sending unencrypted messages that a resourceful threat actor could easily intercept.

Unfortunately, until Apple issues security updates to address the flaws targeted by NSO Group's FORCEDENTRY exploit, the only thing potential targets could do to protect themselves is to disable all apps the Israeli surveillance firm could potentially target.

Improve this answer
1
  • Does the recent fix by Apple remedy these issues? Or are there still strains of Pegasus that could still be used to infect iPhones?
    – Albert Kinterman
    Sep 22, 2021 at 6:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .