The Million Dollar Dissident: NSO Group's i. Phone Zero- Days used against a UAE Human Rights Defender. Research / Targeted Threats. The Million Dollar Dissident NSO Group’s i. Phone Zero- Days used against a UAE Human Rights Defender.

Popurls encapsulates headlines from the most popular websites on a single page and is also known as the mother of all news aggregators. Invented 2005 by Thomas Marban.

This report was written with the assistance of the research team at Lookout Security. Update (Sept 1, 2. Today Apple released security updates for Desktop Safari and Mac OS X. These updates patch the Trident vulnerabilities that identified in this report for desktop users. The Trident vulnerabilities used by NSO could have been weaponized against users of non i. Watch Zaytoun Online Hoyts. OS devices, including OSX. We encourage all Apple users to install the update as soon as possible. Citizen Lab is not releasing samples of the attack at this time to protect the integrity of still- ongoing investigations.

This report describes how a government targeted an internationally recognized human rights defender, Ahmed Mansoor, with the Trident, a chain of zero- day exploits designed to infect his i. Phone with sophisticated commercial spyware. Executive Summary. Ahmed Mansoor is an internationally recognized human rights defender, based in the United Arab Emirates (UAE), and recipient of the Martin Ennals Award (sometimes referred to as a “Nobel Prize for human rights”). On August 1. 0 and 1.

Mansoor received SMS text messages on his i. Phone promising “new secrets” about detainees tortured in UAE jails if he clicked on an included link. Instead of clicking, Mansoor sent the messages to Citizen Lab researchers. We recognized the links as belonging to an exploit infrastructure connected to NSO Group, an Israel- based “cyber war” company that sells Pegasus, a government- exclusive “lawful intercept” spyware product. NSO Group is reportedly owned by an American venture capital firm, Francisco Partners Management. The ensuing investigation, a collaboration between researchers from Citizen Lab and from Lookout Security, determined that the links led to a chain of zero- day exploits (“zero- days”) that would have remotely jailbroken Mansoor’s stock i. Phone 6 and installed sophisticated spyware.

Watch Absentia Online Mic Test

We are calling this exploit chain Trident. Once infected, Mansoor’s phone would have become a digital spy in his pocket, capable of employing his i. Phone’s camera and microphone to snoop on activity in the vicinity of the device, recording his Whats. App and Viber calls, logging messages sent in mobile chat apps, and tracking his movements. We are not aware of any previous instance of an i. Phone remote jailbreak used in the wild as part of a targeted attack campaign, making this a rare find. The Trident Exploit Chain: CVE- 2.

Visiting a maliciously crafted website may lead to arbitrary code execution. CVE- 2. 01. 6- 4. An application may be able to disclose kernel memory. CVE- 2. 01. 6- 4. An application may be able to execute arbitrary code with kernel privileges.

Once we confirmed the presence of what appeared to be i. OS zero- days, Citizen Lab and Lookout quickly initiated a responsible disclosure process by notifying Apple and sharing our findings. Apple responded promptly, and notified us that they would be addressing the vulnerabilities. We are releasing this report to coincide with the availability of the i. OS 9. 3. 5 patch, which blocks the Trident exploit chain by closing the vulnerabilities that NSO Group appears to have exploited and sold to remotely compromise i. Phones. Recent Citizen Lab research has shown that many state- sponsored spyware campaigns against civil society groups and human rights defenders use “justenough” technical sophistication, coupled with carefully planned deception.

Watch Absentia Online Microphone

This case demonstrates that not all threats follow this pattern. The i. Phone has a well- deserved reputation for security. As the i. Phone platform is tightly controlled by Apple, technically sophisticated exploits are often required to enable the remote installation and operation of i. Phone monitoring tools. These exploits are rare and expensive. Firms that specialize in acquiring zero- days often pay handsomely for i. Phone exploits.  One such firm, Zerodium, acquired an exploit chain similar to the Trident for one million dollars in November 2.

Eleven men went on trial on Wednesday over the deaths of 71 migrants found in an abandoned truck in Austria nearly two years ago, in one of the most. The Laser-Guided Karma trope as used in popular culture. While in Real Life there is rarely a direct and easily traced cause-and-effect relationship between.

The high cost of i. Phone zero- days, the apparent use of NSO Group’s government- exclusive Pegasus product, and prior known targeting of Mansoor by the UAE government provide indicators that point to the UAE government as the likely operator behind the targeting. Remarkably, this case marks the third commercial “lawful intercept” spyware suite employed in attempts to compromise Mansoor. In 2. 01. 1, he was targeted with Fin.

Fisher’s Fin. Spy spyware, and in 2. Hacking Team’s Remote Control System. Both Hacking Team and Fin.

Fisher have been the object of several years of revelations highlighting the misuse of spyware to compromise civil society groups, journalists, and human rights workers. Figure 1: Ahmed Mansoor, the “Million Dollar Dissident.”The attack on Mansoor is further evidence that “lawful intercept” spyware has significant abuse potential, and that some governments cannot resist the temptation to use such tools against political opponents, journalists, and human rights defenders. Our findings also highlight the continuing lack of effective human rights policies and due diligence at spyware companies, and the continuing lack of incentives to address abuses of “lawful intercept” spyware. Our report proceeds as follows: Section 2 provides an overview of the attack against Ahmed Mansoor.

Section 3 details NSO Group’s tradecraft, gleaned from what appears to be a copy of NSO Group documentation leaked in the Hacking Team emails. Section 4 summarizes our technical analysis of the attack against Mansoor (in collaboration with Lookout). Section 5 describes how we found what appears to be the NSO Group’s mobile attack infrastructure while working on our previous Stealth Falcon report. Section 6 links the spyware used in the attack on Mansoor to NSO Group. Section 7 outlinesevidence of other individuals targeted with the infrastructure that we linked to NSO Group, including Mexican journalist Rafael Cabrera.

Ahmed Mansoor was targeted by NSO Group, an Israel-based “cyber war” company that sells Pegasus, a government-exclusive “lawful intercept” spyware product. Elected governments are false fronts coordinated by a global shadow government. An archive of Pro Tools news stories and other Pro Tools Expert content. Fake News Papers Fake News Videos. A Few Abbreviations.

Section 8 explainshow the attack on Mansoor fits into the context of ongoing attacks on UAE dissidents. Section 9 concludes the report. Ahmed Mansoor Targeted With i. Phone Zero- Day. Ahmed Mansoor is an internationally recognized human rights defender, blogger, and member of Human Rights Watch’s advisory committee.

Mansoor, who is based in the UAE, was jailed for eight months in 2. After he was released, Mansoor’s passport was confiscated, his car was stolen, and $1. Mansoor is banned from traveling overseas, and his work continues to attract significant harassment and punishment. On the morning of August 1. Mansoor received an SMS text message that appeared suspicious. The next day he received a second, similar text.

The messages promised “new secrets” about detainees tortured in UAE prisons, and contained a hyperlink to an unfamiliar website. The messages arrived on Mansoor’s stock i. Phone 6 running i. OS 9. 3. 3. Figure 2: Ahmed Mansoor received suspicious text messages in August 2. Credit: Martin Ennals Foundation. Mansoor quickly forwarded the messages to Citizen Lab researchers for investigation. He has good reason to be concerned about unsolicited messages: every year since 2.

Mansoor has been targeted with spyware attacks, including with Fin. Fisher spyware in 2. Hacking Team spyware in 2. Section 8: Ahmed Mansoor and Previous UAE Attacks). Figure 3: SMS text messages received by Mansoor (English: “New secrets about torture of Emiratis in state prisons”). The sender’s phone numbers are spoofed. When Mansoor’s messages reached us, we recognized the links: the domain name webadv. NSO Group (see Section 6: Linking NSO Group Products to the Attack on Mansoor).

We had first come across the NSO Group infrastructure during the course of our earlier research into Stealth Falcon, a UAE- based threat actor (see Section 5: Tracking a Mobile Attack Infrastructure).