Apple Fixes Security Hole Reportedly Used To Hack An iPhone

Apple released a critical software patch to fix a security vulnerability that researchers said could allow hackers to directly infect iPhones and other Apple devices without any user action.

- 

Researchers at the University of Toronto’s Citizen Lab said the security issue was exploited to plant spyware on a Saudi activist’s iPhone. They said they had high confidence that the world’s most infamous hacker-for-hire firm, Israel’s NSO Group, was behind that attack.

The previously unknown vulnerability affected all major Apple devices — iPhones, Macs and Apple Watches, the researchers said. NSO Group responded with a one-sentence statement saying it will continue providing tools for fighting “terror and crime.”

It was the first time a so-called “zero-click” exploit — one that doesn’t require users to click on suspect links or open infected files — has been caught and analyzed, the researchers said. They found the malicious code on Sept. 7 and immediately alerted Apple. The targeted activist asked to remain anonymous, they said.

“We’re not necessarily attributing this attack to the Saudi government,” said researcher Bill Marczak.