Push Admin

‘Next-level' threat: The Apple security flaw, and how do ‘zero-click’ attacks work?

Article (news)

Katy Lee, Agence France-Presse

<div class="embed-wrap"><figure data-feedback="fb:likes,fb:comments"><img alt="Apple has been rushing to develop a fix for a security flaw that allows spyware to be downloaded on an iPhone or iPad without the owner clicking a button. Dado Ruvic illustration, Reuters/file" src="http://sa.kapamilya.com/absnews/abscbnnews/media/2021/reuters/09/14/20210914-usa-apple.jpg"/><figcaption>Apple has been rushing to develop a fix for a security flaw that allows spyware to be downloaded on an iPhone or iPad without the owner clicking a button. <em>Dado Ruvic illustration, Reuters/file</em></figcaption></figure></div><p>Apple has spent the past week rushing to develop a fix for a major security flaw which allows spyware to be downloaded on an iPhone or iPad without the owner even clicking a button.</p><p>But how do such &quot;zero-click&quot; attacks work, and can they be stopped?</p><div><strong>- What is a &#x27;zero-click&#x27; hack? -</strong></div><p>Spying software has traditionally relied on convincing the targeted person to click on a booby-trapped link or file in order to install itself on their phone, tablet or computer. </p><p>&quot;Zero-click takes that threat to the next level,&quot; said John Scott-Railton, senior researcher at Citizen Lab, the Toronto University cybersecurity centre which discovered the Apple flaw. </p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/09/14/21/apple-issues-fix-for-flaw-linked-to-pegasus-spyware">Apple issues fix for flaw linked to Pegasus spyware</a></li></ul><p>With a zero-click attack, the software can sneak its way onto the device without the person needing to be fooled into clicking on the link. </p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/09/02/21/apple-loosens-app-store-rules-on-content-companies">Apple loosens App Store rules on content companies after Japan probe</a></li></ul><p>That grants would-be spies much easier access, not least in an era when people have grown increasingly wary of clicking on suspicious-looking messages. </p><p>In this case, the malware exploited a hole in Apple&#x27;s iMessage software to stealthily install Pegasus, a hugely invasive piece of software that essentially turns a phone into a pocket listening device. </p><p>Allegations that the software has been used by governments worldwide to eavesdrop on human rights activists, business executives and politicians sparked a global scandal in July. </p><div><strong>- Will I know if my phone is infected? -</strong></div><p>A simple answer: &quot;No,&quot; said Scott-Railton.</p><p>&quot;There&#x27;s nothing you can do as a user to protect yourself from infection, and nothing you&#x27;re going to see when you&#x27;re infected,&quot; he told AFP. </p><p>That is partly why Apple has taken the threat so seriously, he said.</p><p>Scott-Railton urged Apple users to install the software update released by the tech giant on Monday. </p><p>Apple announced a fix for the problem just under a week after Citizen Lab reported it on September 7. </p><p>A fix of this speed is &quot;a rarity, even for a big company&quot;, Scott-Railton said. </p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/06/29/21/spending-in-mobile-apps-surges-to-new-high-survey">Spending in mobile apps surges to new high: survey</a></li></ul><div><strong>- Why are messaging apps so vulnerable? -</strong></div><p>Revelations of Apple&#x27;s iMessage flaw come after messaging service WhatsApp discovered in 2019 that it, too, had a zero-click vulnerability that was being used to install Pegasus on phones.</p><p>Scott-Railton said the ubiquity of such apps meant it was not surprising that the NSO Group, the scandal-hit Israeli company behind Pegasus, had used them to sneak onto people&#x27;s devices.</p><p>&quot;If you find a phone, there&#x27;s a good chance that there&#x27;s a popular messaging app on it,&quot; he explained.</p><p>&quot;Finding a way to infect phones through messaging apps is an easy and quick way to accomplishing what you want.&quot;</p><p>The fact that messaging apps allow people to be identified with their phone numbers, which are easily locatable, also &quot;means that there are a huge target for both nation-states and commercial mercenary hacking operations like NSO,&quot; he said. </p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/06/21/21/amazon-apple-most-valuable-brands-but-chinas-rising-kantar-survey">Amazon, Apple most valuable brands but China&#x27;s rising - Kantar survey</a></li></ul><div><strong>- Can such hacks be stopped? - </strong></div><p>Vivien Raoul, chief technical officer at French cybersecurity firm Pradeo, said the discovery of the iMessage flaw was &quot;a good start for reducing the ports of entry, but it&#x27;s unfortunately not enough to stop Pegasus&quot;.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/06/05/21/g7-nations-strike-deal-to-tax-big-companies-squeeze-havens">G7 nations strike deal to tax big companies, squeeze havens</a></li></ul><p>Malware-makers can simply look for other weaknesses in widely used apps, which inevitably include flaws from time to time due to their complexity, say experts.</p><p>Google&#x27;s mobile operating system Android and Apple&#x27;s iOS regularly &quot;correct a large number of vulnerabilities&quot;, Raoul said. </p><p>NSO, whose recruits include former elite members of Israeli military intelligence, has formidable resources of its own to invest in the hunt for weak spots, while hackers also sell access to them on the dark web. </p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/business/04/29/21/better-days-ahead-apple-profit-doubles-in-quarter-to-236-billion">‘Better days ahead’: Apple profit doubles in quarter to $23.6 billion</a></li></ul><div><strong>FROM THE ARCHIVES</strong></div><figure class="op-interactive"><iframe allow="autoplay; fullscreen" frameBorder="0" height="100%" id="ivsplayer01" scrolling="no" src="https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&amp;key=e8c22c015ca9eafa76f1e3edfa03c603&amp;spid=3001339&amp;vid=1664395" width="100%"></iframe></figure><div class="iwantbar">Watch more in <a href="//www.iwantv.com.ph/">iWantv</a> or <a href="//tfc.tv/">TFC.tv</a></div>

Apple is rushing to develop a fix for a security flaw that allows spyware to be downloaded on an iPhone or iPad without the owner clicking a button.

‘Next-level' threat: The Apple security flaw, and how do ‘zero-click’ attacks work?

News

Entertainment

Lifestyle

Sports

Metro.Style

More

Traffic

Manila

Horoscope

Business

‘Next-level' threat: The Apple security flaw, and how do ‘zero-click’ attacks work?

Katy Lee,

Agence France-Presse

Published Sep 15, 2021 03:04 AM PHT

Read More:

ANC

Apple

zero click attacks

iPhone

iPad

spyware

ABS-CBN is the leading media and entertainment company in the Philippines, offering quality content across TV, radio, digital, and film. Committed to public service and promoting Filipino values, ABS-CBN continues to inspire and connect audiences worldwide.

Corporate

Investors

Governance

International Distribution

Corporate

Governance

Investors

International Distribution

NPC Seal of Registration

Privacy Policy

AI Policy

Terms of Service

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.