{"uuid": "d6df976f-2c58-4613-be8f-26d5165c7333", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30860", "type": "seen", "source": "https://t.me/hacking_Attack/23632", "content": "Black Hat Ethical Hacking\nApple Issues Emergency Fix for NSO Zero-Click Zero Day\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Apple Issues Emergency Fix for NSO Zero-Click Zero DayPost Views: 103 \nReading Time: 2 Minutes\nApple users should immediately update all their devices \u2013 iPhones, iPads, Macs and Apple Watches \u2013 to install an emergency patch for a zero-click zero-day exploited by NSO Group to install spyware.\nCitizen Lab urges Apple users to update immediately. The new zero-click zero-day ForcedEntry flaw affects all things Apple: iPhones, iPads, Macs and Watches.\nThe security updates, pushed out by Apple on Monday, include iOS 14.8\u00a0for iPhones and iPads, as well as new updates for Apple Watch and macOS. The patches will fix at least one vulnerability that the tech behemoth said \u201cmay have been actively exploited.\u201d\n\nCitizen Lab first discovered\u00a0the never-before-seen, zero-click exploit, which it detected targeting iMessaging, last month. It\u2019s allegedly been used to illegally spy on Bahraini activists with NSO Group\u2019s Pegasus spyware, according to the cybersecurity watchdog.\n\nThe digital researchers dubbed the new iMessaging exploit ForcedEntry.\n\nCitizen Group said in August that they had identified nine Bahraini activists whose iPhones were inflicted with Pegasus spyware between June 2020 and February 2021. Some of the activists\u2019 phones suffered zero-click iMessage attacks that, besides ForcedEntry, also included the 2020 KISMET exploit.\n\nThe activists included three members of Waad\u00a0(a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini dissidents, and one member of Al Wefaq\u00a0(a Shiite Bahraini political society), Citizen Lab wrote.\nSee Also: Complete Offensive Security and Ethical Hacking Course The ForcedEntry exploit was particularly notable in that it was successfully deployed against the latest iOS versions \u2013 14.4 & 14.6 \u2013 blowing past Apple\u2019s new BlastDoor sandboxing feature to install spyware on the iPhones of the Bahraini activists.\n\nCitizen Lab first observed NSO Group deploying ForcedEntry in February 2021. Apple had just introduced BlastDoor, a structural improvement in iOS 14 meant to block message-based, zero-click exploits like these NSO Group-associated attacks \u2013 the month before. BlastDoor was supposed to prevent this type of Pegasus attack by acting as what Google Project Zero\u2019s Samuel Gro\u00df called\u00a0a \u201ctightly sandboxed\u201d service responsible for \u201calmost all\u201d of the parsing of untrusted data in iMessages.\n\nIn a post\u00a0on Monday, Citizen Lab researchers said that in March 2021, they had examined the phone of a Saudi activist who requested anonymity and determined that the phone had been infected with NSO Group\u2019s Pegasus spyware. Last Tuesday, Sept. 7, Citizen Lab forwarded artifacts from two types of crashes on another phone that had been infected with Pegasus, suspecting that both infections showed parts of the ForcedEntry exploit chain.\n\nCitizen Lab forwarded the artifacts to Apple on Tuesday, Sept. 7. On Monday, Sept. 13, Apple confirmed that the files included a zero-day exploit against iOS and MacOS. Apple has designated the ForcedEntry exploit CVE-2021-30860: an as-yet-unrated flaw that Apple describes as \u201cprocessing a maliciously crafted PDF may lead to arbitrary code execution.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges Sniffing out NSO Group\u2019s TracksCitizen Lab described several distinct elements that gives researchers high confidence that the exploit can be tied to the secretive Israeli spyware maker NSO Group, including a forensic artifact called CascadeFail.\n\nCascadeFail is a bug whereby \u201cevidence i[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:56.334081Z"}