FORCEDENTRY

The exploit was discovered by Citizen Lab,{{Cite web|title=Apple fixes iOS zero-day used to deploy NSO iPhone spyware|url=https://www.bleepingcomputer.com/news/apple/apple-fixes-ios-zero-day-used-to-deploy-nso-iphone-spyware/|access-date=2021-09-14|website=BleepingComputer|language=en-us}} who reported that the vulnerability has been used to target political dissidents and human rights activists.{{cite journal|url=https://citizenlab.ca/2021/08/bahrain-hacks-activists-with-nso-group-zero-click-iphone-exploits/|title=Bahraini Government Hacks Activists with NSO Group Zero-Click iPhone Exploits|accessdate=24 August 2021|website=Citizenlab|date=24 August 2021|last1=Marczak |first1=Bill |last2=Abdulemam |first2=Ali |last3=Al-Jizawi |first3=Noura |last4=Anstis |first4=Siena |last5=Berdan |first5=Kristin |last6=Scott-Railton |first6=John |last7=Deibert |first7=Ron }} FORCEDENTRY appears to be the same as the attack previously detected and named "Megalodon" by Amnesty International.{{Cite web|title=Bahrain targets activists with NSO's Pegasus spyware|url=https://www.itpro.co.uk/security/spyware/360682/bahrain-targets-activists-with-nsos-pegasus-spyware|access-date=2021-09-15|website=IT PRO|date=24 August 2021 |language=en}}

The exploit uses PDF files disguised as GIF files to inject JBIG2-encoded data to provoke an integer overflow{{Cite web|last=Claburn|first=Thomas|title=Apple emergency patches fix zero-click iMessage bug used to inject NSO spyware|url=https://www.theregister.com/2021/09/13/apple_ios_macos_security_fixes/|access-date=2021-09-15|website=www.theregister.com|language=en}}{{Cite web|title=About the security content of macOS Big Sur 11.6|url=https://support.apple.com/en-us/HT212804|access-date=2021-09-14|website=Apple Support|language=en}} in Apple's CoreGraphics system, circumventing Apple's "BlastDoor" sandbox for message content. BlastDoor was introduced as part of iOS 14 to defend against KISMET, another zero-click exploit.{{Cite journal|date=2021-09-13|title=FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild|url=https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/|access-date=2021-09-13|website=The Citizen Lab|language=en-US|last1=Marczak |first1=Bill |last2=Scott-Railton |first2=John |last3=Razzak |first3=Bahr Abdul |last4=Al-Jizawi |first4=Noura |last5=Anstis |first5=Siena |last6=Berdan |first6=Kristin |last7=Deibert |first7=Ron }}{{Cite web|title=New iOS Zero-Click Exploit Defeats Apple 'BlastDoor' Sandbox|url=https://www.securityweek.com/new-ios-zero-click-exploit-defeats-apple-blastdoor-sandbox|access-date=2021-09-14|website=www.securityweek.com|date=24 August 2021 }} The FORCEDENTRY exploit has been given the CVE identifier CVE-2021-30860. In December 2021, Google's Project Zero team published a technical breakdown of the exploit based on its collaboration with Apple’s Security Engineering and Architecture (SEAR) group.{{Cite web|last1=Beer|first1=Ian|last2=Groß|first2=Samuel|date=2021-12-15|title=Project Zero: A deep dive into an NSO zero-click iMessage exploit: Remote Code Execution|url=https://googleprojectzero.blogspot.com/2021/12/a-deep-dive-into-nso-zero-click.html|access-date=2021-12-16|website=Google Project Zero}}{{Cite web|url=https://uk.pcmag.com/security/137712/google-project-zero-goes-deep-on-forcedentry-exploit-used-by-nso-group|title = Google Project Zero Goes Deep on FORCEDENTRY Exploit Used by NSO Group|date = 15 December 2021}}

The exploit was described by Project Zero team:

JBIG2 doesn't have scripting capabilities, but when combined with a vulnerability, it does have the ability to emulate circuits of arbitrary logic gates operating on arbitrary memory. So why not just use that to build your own computer architecture and script that!? That's exactly what this exploit does. Using over 70,000 segment commands defining logical bit operations, they define a small computer architecture with features such as registers and a full 64-bit adder and comparator which they use to search memory and perform arithmetic operations. It's not as fast as Javascript, but it's fundamentally computationally equivalent.

The bootstrapping operations for the sandbox escape exploit are written to run on this logic circuit and the whole thing runs in this weird, emulated environment created out of a single decompression pass through a JBIG2 stream. It's pretty incredible, and at the same time, pretty terrifying.

According to Citizen Lab, the FORCEDENTRY vulnerability exists in iOS versions prior to 14.8, macOS versions prior to macOS Big Sur 11.6 and Security Update 2021-005 Catalina, and watchOS versions prior to 7.6.2.

In November 2021, Apple Inc. filed a complaint against NSO Group and its parent company Q Cyber Technologies in the United States District Court for the Northern District of California in relation to FORCEDENTRY, requesting injunctive relief, compensatory damages, punitive damages, and disgorgement of profits{{Cite web|last=Kirchgaessner|first=Stephanie|date=2021-11-23|title=Apple sues Israeli spyware firm NSO Group for surveillance of users|url=https://www.theguardian.com/technology/2021/nov/23/apple-sues-israeli-cyber-firm-nso-group|access-date=2021-11-23|website=the Guardian|language=en}}{{Cite web|title=Apple sues NSO Group to curb the abuse of state-sponsored spyware|url=https://www.apple.com/newsroom/2021/11/apple-sues-nso-group-to-curb-the-abuse-of-state-sponsored-spyware/|access-date=2021-11-23|website=Apple Newsroom|language=en-US|date=2021-11-23}}{{Cite web|title=APPLE INC., v. NSO GROUP TECHNOLOGIES LIMITED, and Q CYBER TECHNOLOGIES LIMITED|url=https://www.apple.com/newsroom/pdfs/Apple_v_NSO_Complaint_112321.pdf|accessdate=2021-11-23}} but in 2024 asked the court to dismiss the lawsuit.{{Cite web|title=Apple seeks to drop its lawsuit against Israeli spyware pioneer NSO|url=https://www.washingtonpost.com/technology/2024/09/13/apple-lawsuit-nso-pegasus-spyware/}}{{Cite web|title=Israel tried to frustrate US lawsuit over Pegasus spyware, leak suggests|url=https://www.theguardian.com/news/article/2024/jul/25/israel-tried-to-frustrate-us-lawsuit-over-pegasus-spyware-leak-suggests}}

• iMessage

{{Reflist}}

{{Hacking in the 2020s}}

Category:Spyware

Category:Privilege escalation exploits

Category:MacOS malware