Apple sues NSO Group over spyware abuses


Apple announced that it has filed a lawsuit against the Israeli NSO Group, maker of government surveillance tools. The spy tools leverage undiscovered exploits in hardware and software. Some of the most public exploits have targeted Apple devices.

Apple’s legal complaint provides new information on NSO Group’s FORCEDENTRY, an exploit for a now-patched vulnerability previously used to break into a victim’s Apple device and install the latest version of NSO Group’s spyware product, Pegasus. The exploit was originally identified by the Citizen Lab, a research group at the University of Toronto.

The spyware was used to attack a small number of Apple users worldwide with dangerous malware and spyware. Apple’s lawsuit seeks to ban NSO Group from further harming individuals by using Apple’s products and services. The lawsuit also seeks redress for NSO Group’s flagrant violations of US federal and state law, arising out of its efforts to target and attack Apple and its users.

NSO Group claims its software helps governments stop criminals such as terrorists and child predators, however, the software has a poor track record of abuse by its customers. These abuses have been reported extensively over the years by the Toronto-based Citizen Lab research group.

Facebook currently has a lawsuit pending over exploits with its WhatsApp messaging software. The U.S. government has also blacklisted NSO Group due to abuses of its products. The status means U.S.-based companies and state/local governments are prohibited from doing business with the company.

The interesting part of the lawsuit alleges the NSO Group created fake Apple IDs and utilized Apple's services to carry out attacks. This would seem to be a strong angle for Apple's lawsuit as their services intentionally violate Apple's terms of services

To deliver FORCEDENTRY to Apple devices, attackers created Apple IDs to send malicious data to a victim’s device â€" allowing NSO Group or its clients to deliver and install Pegasus spyware without a victim’s knowledge. Though misused to deliver FORCEDENTRY, Apple servers were not hacked or compromised in the attacks.

Apple's press release is crafted to illustrate the dangers, but also state the effects are limited to a few of its customers. Also, that it has been proactive in fixing exploits as they become known. Last spring, Apple issued what it described as an emergency patch believed to have addressed discovered NSO Group exploits. Apple also promoted iOS 15, which Apple said, to its knowledge, has not been compromised.