At least two rival hacking businesses from Israel managed to gain remote access to iPhones last year. What's more, they managed to do so without the help of malicious links of any kind.
After an Israeli surveillance firm, NSO Group, broke into iPhone last year, (and following an Apple lawsuit), five individuals aware of the intrusions disclosed that another Israeli firm, QuaDream, broke into consumer iPhones around the same time in 2021.
To all the information in "zero klicks"
According to expert analysis, both spyware companies used a similar advanced hacking technique, known in tech circles as the "zero-click" method, that allows threat actors to compromise iPhones – without the victim even needing to open a malicious link.
Furthermore, an exploit (a programmer code designed to take advantage of a vulnerability in a computer system and ultimately give a threat actor unauthorized access to data) called ForcedEntry was used in both cases. ForcedEntry is considered "one of the most technically sophisticated exploits" captured by security institutions to this day.
Analysts agree that the NSO and QuaDream's exploits were made even more similar by the fact that they mostly leveraged the same vulnerabilities hidden inside iMessage and used the same sophisticated techniques to implement malware – the analysts agree. The campaigns turned out to be so alike that when Apple patched the aforementioned flaws in September 2021, both instances of spy software became utterly ineffective. This led some experts to suspect possible cooperation between the two surveillance firms.
According to Reuters, the online publication that was the first to uncover QuaDream's intrusions, both QuaDream and Apple refused to comment on this news. An NSO spokeswoman, on the other hand, made a written statement claiming that the company "did not cooperate" with QuaDream. She also used the opportunity to highlight that: "The cyber intelligence industry continues to grow rapidly globally".
The social role of spyware companies
Despite its reputation, NSO never admitted any wrongdoing. In fact, following the Apple lawsuit in September, the spy firm made a statement saying it "will continue to provide intelligence and law enforcement agencies around the world with life-saving technologies to fight terror and crime".
People want to believe they're secure, and phone companies want you to believe they're secure. What we've learned is, they're not ...
This doesn't come as a surprise, considering most contemporary spyware companies insist they only sell their software technology to help governments protect national security. Human rights activists and the press, however, continue to report cases of spyware being used wrongfully – and even endangering civil society. They argue that leading parties use these means to interfere with elections, sabotage opposition, and for similar political mass-surveillance schemes. Mexican, Indonesian, and Saudi officials are just some on the long list of governments paying for these services, with many already accused of misusing them.
Apple and privacy
Since its inception, Apple has been one of the world's most security-conscious tech giants, and plenty of customers choose the brand for that particular reason. However, it now seems as though online security and privacy are perpetually at risk – and Apple itself isn't exempt from this trend.
In November last year, Apple notified thousands of its users of ForcedEntry activities on their devices, making prominent politicians, news reporters, and other victims realize how easy it is for their privacy to get compromised and that nobody is immune. The company promised that it "continuously and successfully fends off a variety of hacking attempts".
However, with a second attack on iPhone software discovered within only a few months of the first, it seems that this will be more challenging than the tech company thought, or was ready to admit.