What To Know About IOS 16.6.1: Apple’s Emergency Software Update

Topline

After the controversial Pegasus spyware created by Israel-based NSO Group was discovered on iPhones and iPads, Apple released an emergency software update on Thursday to patch up the vulnerability.

Key Facts

Researchers at Citizen Lab—an arm of the University of Toronto—said on Thursday they discovered the spyware, called Pegasus, on the Apple device of an employee of a Washington-based civil society organization.

Pegasus allowed users to send attachments via iMessage with hidden code to unsuspecting victims—what Citizen Lab refers to as BLASTPASS—that then allowed the spyware to take over the device’s functions “without any interaction from the victim,” according to the Citizen Lab statement.

The update also addresses another issue affecting Apple Wallet, where users store credit and debit card information, though Apple didn’t go into detail about the specific vulnerability.

Though the spyware has been accused in the past of targeting government officials and journalists, Citizen Lab urges all Apple users to update their devices and encourages those who may face “increased risk” to use Lockdown Mode—an Apple emergency protection that reduces cyberattacks.

NSO told Reuters it didn’t have an immediate comment regarding the Citizen Lab research.

Crucial Quote

“This latest find shows once again that civil society is targeted by highly sophisticated exploits and mercenary spyware,” the Citizen Lab statement reads.

Key Background

NSO’s spyware has been under scrutiny for several years for its ability to pull photos, videos, location data, encrypted communications, text messages and contacts from devices without the knowledge of users. After a group of media organizations claimed NSO’s spyware may have been used to target the devices of world leaders and journalists, from places like Morocco and France in 2021, House Democrats called for NSO to be blacklisted and potentially sanctioned. Later that year, the U.S. government blacklisted NSO for allegedly surveilling journalists, lawyers and government officials. After NSO used its spyware to hack into popular messaging platform WhatsApp, the platform’s owner Meta, along with other tech giants, like Amazon and Apple, sued NSO for exploiting a bug in the app. The suit, which is ongoing, alleges the spyware was used to spy on over 1,400 people, including journalists and human rights activists. The Israeli company argued it was exempt from being sued because it acted as an agent for foreign governments and it can’t see who the targets are.

What To Watch For

Citizen Lab didn’t provide the name of the exploited employee or company, but it said in its statement that it will release more details on the exploit chain in the future.